CVE-2026-47190 Details
Description
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.
A vulnerability exists in the IP Address Manager (IPAM) for Cluster API Provider Metal3, specifically in versions prior to 1.11.7, 1.12.4, and 1.13.0. The issue arises from the IPAM controller's ClusterRole, which granted excessive permissions allowing full CRUD (create, read, update, delete) operations on core/v1 Secrets. Although the controller does not typically interact with Secrets, this over-privilege could be exploited if the controller pod were compromised, such as through a supply chain attack or container escape. An attacker could then access, modify, or delete Secrets within the namespace, potentially exposing sensitive information like credentials.
Users should upgrade to IP Address Manager versions 1.11.7, 1.12.4, or 1.13.0. Alternatively, the unnecessary Secrets permissions can be manually removed from the ClusterRole assigned to the IPAM controller.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/metal3-io/ip-address-manager/pull/1355 | [email protected] | Issue TrackingPatch |
| https://github.com/metal3-io/ip-address-manager/pull/1356 | [email protected] | Issue TrackingPatch |
| https://github.com/metal3-io/ip-address-manager/pull/1357 | [email protected] | Issue TrackingPatch |
| https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| metal3 ip-address-manager | >= 1.11.0, < 1.11.7 >= 1.12.0, < 1.12.4 1.13.0 beta0 1.13.0 rc0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |