CVE-2026-47190

Katalog CVE

CVSS 4.4 · Medium EPSS 0,42%

Kerentanan Execution with Unnecessary Privileges pada metal3 ip-address-manager. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq mitigasi · advisory vendor
• https://github.com/metal3-io/ip-address-manager/pull/1355 issue tracking · patch
• https://github.com/metal3-io/ip-address-manager/pull/1356 issue tracking · patch
• https://github.com/metal3-io/ip-address-manager/pull/1357 issue tracking · patch