CVE-2026-47190

{
  "id": "CVE-2026-47190",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T16:16:29.643",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0."
    },
    {
      "lang": "es",
      "value": "IPAM es el Gestor de dirección IP para Cluster API Provider Metal3. Antes de las versiones 1.11.7, 1.12.4 y 1.13.0, el ClusterRole del controlador IPAM otorgaba permisos CRUD completos (crear, eliminar, obtener, listar, parchear, actualizar, observar) sobre Secrets de core/v1. El controlador nunca accede a Secrets durante la operación normal. Si el pod del controlador fuera comprometido (por ejemplo, mediante un ataque a la cadena de suministro o un escape de contenedor), un atacante podría aprovechar estos permisos excesivos para leer, modificar o eliminar Secrets en el espacio de nombres, exponiendo potencialmente credenciales y otros datos sensibles. Este problema ha sido parcheado en las versiones 1.11.7, 1.12.4 y 1.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "metal3-io",
          "product": "ip-address-manager",
          "versions": [
            {
              "version": "< 1.11.7",
              "status": "affected"
            },
            {
              "version": "< 1.12.4",
              "status": "affected"
            },
            {
              "version": "< 1.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-13T03:18:02.798663Z",
          "id": "CVE-2026-47190",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:metal3:ip-address-manager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.11.0",
              "versionEndExcluding": "1.11.7",
              "matchCriteriaId": "17A1B2B9-82E2-46CF-AD10-E4FC92F7AA53"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:metal3:ip-address-manager:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.12.0",
              "versionEndExcluding": "1.12.4",
              "matchCriteriaId": "A1236AE2-DFF2-4BA8-93ED-4FF141ABDB71"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:metal3:ip-address-manager:1.13.0:beta0:*:*:*:*:*:*",
              "matchCriteriaId": "70F84CF0-52E5-4CE1-AB0E-F0D89186423E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:metal3:ip-address-manager:1.13.0:rc0:*:*:*:*:*:*",
              "matchCriteriaId": "5ADBE108-926D-4851-84A3-784D5530F72C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/metal3-io/ip-address-manager/pull/1355",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/metal3-io/ip-address-manager/pull/1356",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/metal3-io/ip-address-manager/pull/1357",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}