CVE-2026-47190— IPAM controller service account granted unnecessary full access to Secrets
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| metal3-io | ip-address-manager | < 1.11.7 | affected |
< 1.12.4 | affected | ||
< 1.13.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47190
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IPAM controller service account granted unnecessary full access to Secrets
Source: NVD (National Vulnerability Database)
Vulnerability Description
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
带着不必要的权限执行
Source: NVD (National Vulnerability Database)
Vulnerability Title
Metal³ Metal3 IP Address Manager for Cluster API Provider Metal3 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Metal³组织开源的Metal3 IP Address Manager for Cluster API Provider Metal3是一个为静态IP地址分配的控制器。 Metal³ Metal3 IP Address Manager for Cluster API Provider Metal3 1.11.7之前版本、1.12.4之前版本和1.13.0之前版本存在权限许可和访问控制问题漏洞，该漏洞源于IPAM controller的ClusterRole授予了核心/v1 Secrets的完全CRUD权
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| metal3-io | ip-address-manager | < 1.11.7 | - |
II. Public POCs for CVE-2026-47190
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47190
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47190 (3)
Vendor Advisories for CVE-2026-47190 (1)
IV. Related Vulnerabilities
Same vendor: metal3-io
- CVE-2025-29781
Bare Metal Operator (BMO) can expose any secret from other n - CVE-2024-43803
BMO can expose particularly named secrets from other namespa - CVE-2024-31463
Ironic-image allows unauthenticated local access to Ironic A - CVE-2023-40585
Unauthenticated access to Ironic API - CVE-2023-30841
Ironic and ironic-inspector deployed within Baremetal Operat
V. Comments for CVE-2026-47190
No comments yet