—
GO-2025-3939
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
Quick fix
GO-2025-3939 — sigs.k8s.io/secrets-store-sync-controller: upgrade to the fixed version with the command below.
go get sigs.k8s.io/secrets-store-sync-controller@v0.0.2Details
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/sigs.k8s.io/secrets-store-sync-controller
Introduced in:
0Fixed in: 0.0.2Fix
go get sigs.k8s.io/secrets-store-sync-controller@v0.0.2References
- https://github.com/kubernetes-sigs/secrets-store-sync-controller/security/advisories/GHSA-rcw7-pqfp-735x[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2025-7445[ADVISORY]
- https://github.com/kubernetes/kubernetes/issues/133897[WEB]
- https://groups.google.com/g/kubernetes-security-announce/c/NP7cQvQ1aGA[WEB]