GHSA-49pm-43hf-6xfq

Source

https://github.com/advisories/GHSA-49pm-43hf-6xfq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-49pm-43hf-6xfq/GHSA-49pm-43hf-6xfq.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-49pm-43hf-6xfq

Aliases

CVE-2026-47190

Published

2026-05-29T18:24:45Z

Modified

2026-05-29T18:30:08.730196656Z

Severity

4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

IPAM controller service account granted unnecessary full access to Secrets

Details

Impact

IPAM is the IP address Manager for Cluster API Provider Metal3. The IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data.

All users running ip-address-manager versions prior to the patched releases are affected.

Patches

Fixed in: - v1.11.7 - v1.12.4 - v1.13.0

Users should upgrade to the patched version for their release branch.

Workarounds

Manually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole:

# Remove this entire block from the ClusterRole
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch

Resources

https://github.com/metal3-io/ip-address-manager/pull/1355
https://github.com/metal3-io/ip-address-manager/pull/1356 (backport to release-1.12)
https://github.com/metal3-io/ip-address-manager/pull/1357 (backport to release-1.11)

Database specific

{
    "github_reviewed_at": "2026-05-29T18:24:45Z",
    "cwe_ids": [
        "CWE-250"
    ],
    "nvd_published_at": null,
    "github_reviewed": true,
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/metal3-io/ip-address-manager

Package

Name: github.com/metal3-io/ip-address-manager; View open source insights on deps.dev
Purl: pkg:golang/github.com/metal3-io/ip-address-manager

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-49pm-43hf-6xfq/GHSA-49pm-43hf-6xfq.json"

last_known_affected_version_range

"<= 1.11.6"