PT-2026-45027 · Go+1 · Github.Com/Metal3-Io/Ip-Address-Manager+1

Published 2026-05-29 · Updated 2026-06-12 · CVE-2026-47190

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IPAM versions prior to 1.11.7 IPAM versions prior to 1.12.4 IPAM versions prior to 1.13.0

Description The IPAM controller's ClusterRole grants excessive CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets, despite the controller not requiring access to Secrets during normal operation. If the controller pod is compromised through a container escape or supply chain attack, an attacker could use these permissions to read, modify, or delete Secrets within the namespace, leading to the potential exposure of credentials and sensitive data.

Recommendations Update to version 1.11.7 Update to version 1.12.4 Update to version 1.13.0 As a temporary workaround, manually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2026-47190

GHSA-49PM-43HF-6XFQ

Affected Products

Github.Com/Metal3-Io/Ip-Address-Manager

Ip Address Manager

References · 7

• https://osv.dev/vulnerability/GHSA-49pm-43hf-6xfq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47190 · Security Note
• https://github.com/metal3-io/ip-address-manager · Note
• https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq · Note
• https://github.com/metal3-io/ip-address-manager/pull/1356 · Note
• https://github.com/metal3-io/ip-address-manager/pull/1357 · Note
• https://github.com/metal3-io/ip-address-manager/pull/1355 · Note