CVE-2026-47190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47190", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T22:07:37.435Z", "datePublished": "2026-06-12T14:49:51.732Z", "dateUpdated": "2026-06-13T03:18:15.986Z"}, "containers": {"cna": {"title": "IPAM controller service account granted unnecessary full access to Secrets", "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "lang": "en", "description": "CWE-250: Execution with Unnecessary Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq"}, {"name": "https://github.com/metal3-io/ip-address-manager/pull/1355", "tags": ["x_refsource_MISC"], "url": "https://github.com/metal3-io/ip-address-manager/pull/1355"}, {"name": "https://github.com/metal3-io/ip-address-manager/pull/1356", "tags": ["x_refsource_MISC"], "url": "https://github.com/metal3-io/ip-address-manager/pull/1356"}, {"name": "https://github.com/metal3-io/ip-address-manager/pull/1357", "tags": ["x_refsource_MISC"], "url": "https://github.com/metal3-io/ip-address-manager/pull/1357"}], "affected": [{"vendor": "metal3-io", "product": "ip-address-manager", "versions": [{"version": "< 1.11.7", "status": "affected"}, {"version": "< 1.12.4", "status": "affected"}, {"version": "< 1.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T14:49:51.732Z"}, "descriptions": [{"lang": "en", "value": "IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0."}], "source": {"advisory": "GHSA-49pm-43hf-6xfq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-13T03:18:02.798663Z", "id": "CVE-2026-47190", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T03:18:15.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-13T03:18:02.798663Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T03:18:09.572Z"}}], "cna": {"title": "IPAM controller service account granted unnecessary full access to Secrets", "source": {"advisory": "GHSA-49pm-43hf-6xfq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "metal3-io", "product": "ip-address-manager", "versions": [{"status": "affected", "version": "< 1.11.7"}, {"status": "affected", "version": "< 1.12.4"}, {"status": "affected", "version": "< 1.13.0"}]}], "references": [{"url": "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq", "name": "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/metal3-io/ip-address-manager/pull/1355", "name": "https://github.com/metal3-io/ip-address-manager/pull/1355", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/metal3-io/ip-address-manager/pull/1356", "name": "https://github.com/metal3-io/ip-address-manager/pull/1356", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/metal3-io/ip-address-manager/pull/1357", "name": "https://github.com/metal3-io/ip-address-manager/pull/1357", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250: Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T14:49:51.732Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47190", "state": "PUBLISHED", "dateUpdated": "2026-06-13T03:18:15.986Z", "dateReserved": "2026-05-18T22:07:37.435Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T14:49:51.732Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ip-address-manager", "vendor": "metal3-io", "versions": [{"status": "affected", "version": "< 1.11.7"}, {"status": "affected", "version": "< 1.12.4"}, {"status": "affected", "version": "< 1.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:metal3:ip-address-manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "17A1B2B9-82E2-46CF-AD10-E4FC92F7AA53", "versionEndExcluding": "1.11.7", "versionStartIncluding": "1.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metal3:ip-address-manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1236AE2-DFF2-4BA8-93ED-4FF141ABDB71", "versionEndExcluding": "1.12.4", "versionStartIncluding": "1.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:metal3:ip-address-manager:1.13.0:beta0:*:*:*:*:*:*", "matchCriteriaId": "70F84CF0-52E5-4CE1-AB0E-F0D89186423E", "vulnerable": true}, {"criteria": "cpe:2.3:a:metal3:ip-address-manager:1.13.0:rc0:*:*:*:*:*:*", "matchCriteriaId": "5ADBE108-926D-4851-84A3-784D5530F72C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0."}, {"lang": "es", "value": "IPAM es el Gestor de direcci\u00f3n IP para Cluster API Provider Metal3. Antes de las versiones 1.11.7, 1.12.4 y 1.13.0, el ClusterRole del controlador IPAM otorgaba permisos CRUD completos (crear, eliminar, obtener, listar, parchear, actualizar, observar) sobre Secrets de core/v1. El controlador nunca accede a Secrets durante la operaci\u00f3n normal. Si el pod del controlador fuera comprometido (por ejemplo, mediante un ataque a la cadena de suministro o un escape de contenedor), un atacante podr\u00eda aprovechar estos permisos excesivos para leer, modificar o eliminar Secrets en el espacio de nombres, exponiendo potencialmente credenciales y otros datos sensibles. Este problema ha sido parcheado en las versiones 1.11.7, 1.12.4 y 1.13.0."}], "id": "CVE-2026-47190", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47190", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-13T03:18:02.798663Z", "version": "2.0.3"}}]}, "published": "2026-06-12T16:16:29.643", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/metal3-io/ip-address-manager/pull/1355"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/metal3-io/ip-address-manager/pull/1356"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/metal3-io/ip-address-manager/pull/1357"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/metal3-io/ip-address-manager: Cluster API Provider Metal3 IPAM: Information disclosure via excessive permissions on Secrets", "id": "2488412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488412"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["A flaw was found in the Cluster API Provider Metal3 IP Address Manager (IPAM) controller. The controller's ClusterRole granted excessive permissions, allowing full create, read, update, and delete (CRUD) access to core/v1 Secrets. If the controller pod were compromised, an attacker could leverage these permissions to read, modify, or delete sensitive data within the namespace. This could lead to the exposure of credentials and other sensitive information."], "name": "CVE-2026-47190", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Fix deferred", "package_name": "multicluster-engine/capoa-bootstrap-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-baremetal-cluster-api-controllers-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-baremetal-machine-controllers", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-baremetal-machine-controllers-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-cluster-capi-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-machine-api-operator", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-06-12T14:49:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-47190\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47190\nhttps://github.com/metal3-io/ip-address-manager/pull/1355\nhttps://github.com/metal3-io/ip-address-manager/pull/1356\nhttps://github.com/metal3-io/ip-address-manager/pull/1357\nhttps://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ip-address-manager", "source": "cna", "vendor": "metal3-io"}, "product": "ip-address-manager", "vendor": "metal3-io"}], "created": "2026-06-12T16:30:14.101525+00:00", "updated": "2026-06-17T23:30:04.171350+00:00", "vendors": ["metal3-io", "metal3-io$PRODUCT$ip-address-manager"]}