Impact

Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace was set.
This bypassed the namespace boundary enforced for SecretStore-backed references in providers that rely on the shared runtime CA resolver.

The accessible data is used as CA validation material, hence it is not directly exposed.

Impact:

• Direct data exfiltration risk: low
• Existence disclosure: an attacker can infer whether a target ConfigMap/key exists in another namespace.
• Trust-boundary violation: a tenant can make its SecretStore consume CA material owned by another namespace.

References

• GHSA-wv26-88m5-6h59