---
id: CVE-2026-54495
title: The OpenFeature Operator allows users to expose feature flags to applications
summary: >-
  The OpenFeature Operator allows users to expose feature flags to applications.
  In version 0.9.2 and earlier, a tenant who can create a controller-owned
  workload can use the openfeature.dev/featureflagsource annotation with
  NAMESPACE/NAME…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-668
vendor: open-feature
product: open-feature-operator
affected:
  - open-feature-operator <= 0.9.2
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:20:08.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54495'
references:
  - url: 'https://github.com/open-feature/open-feature-operator/issues/847'
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-feature/open-feature-operator/security/advisories/GHSA-398h-7f66-3h4p
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-398h-7f66-3h4p'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.00306
epssPercentile: 0.20873
aliases:
  - GHSA-398h-7f66-3h4p
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T14:36:49.070602Z'
ingestedAt: '2026-07-15T22:46:58.657Z'
---

## Overview

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace. On multi-tenant clusters that use namespaces as trust boundaries, the cluster-scoped operator reads that resource and materializes spec.envVars literal values, spec.httpSyncBearerToken, sync URIs, and supporting ConfigMaps into the tenant's workload. Single-tenant clusters are not impacted, secretKeyRef and configMapKeyRef values remain namespace-local, and creating a FeatureFlagSource is not required.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54495)

Affected packages:

- `github.com/open-feature/open-feature-operator <= 0.9.2`

Source: https://github.com/advisories/GHSA-398h-7f66-3h4p