CVE-2026-47190

MediumCVSS 4.4/10Last modified Oct 26, 2026

Description

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-250

Affected software

Vendor	Product	Versions
metal3-io	ip-address-manager	< 1.11.7; < 1.12.4; < 1.13.0

References

https://github.com/metal3-io/ip-address-manager/pull/1355Issue Tracking, Patch
https://github.com/metal3-io/ip-address-manager/pull/1356Issue Tracking, Patch
https://github.com/metal3-io/ip-address-manager/pull/1357Issue Tracking, Patch
https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfqMitigation, Vendor Advisory

Timeline

Published: Jun 12, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-471912.1kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify i CVE-2026-471922.1kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories CVE-2026-471937.5OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden hi CVE-2026-471948.6Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-c CVE-2026-471957.1Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the in CVE-2026-471968.4Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result CVE-2026-471977.2Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to mode CVE-2026-471988.5Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component CVE-2026-471992.3Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries,CVE-2026-47209.8Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence CVE-2026-472005.3Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and CVE-2026-472018.5authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is