CVE-2026-47190
Last modified
CVE-2026-47190 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.
Metrics
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Metal3 | Ip-Address-Manager | >= 1.11.0, < 1.11.7 | — |
| Metal3 | Ip-Address-Manager | >= 1.12.0, < 1.12.4 | — |
| Metal3 | Ip-Address-Manager | 1.13.0 | Beta0 |
References
- https://github.com/metal3-io/ip-address-manager/pull/1355Issue Tracking, Patch
- https://github.com/metal3-io/ip-address-manager/pull/1356Issue Tracking, Patch
- https://github.com/metal3-io/ip-address-manager/pull/1357Issue Tracking, Patch
- https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfqMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-47190?
How severe is CVE-2026-47190?
How do I fix CVE-2026-47190?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47183Zeroconf is a pure Python implementation of multicast DNS se…6.5
- CVE-2026-47184Zeroconf is a pure Python implementation of multicast DNS se…6.5
- CVE-2026-47185Frappe is a full-stack web application framework. Prior to 1…5.1
- CVE-2026-47188Quest Bot is an opensource modern Discord Bot built for mode…2.3
- CVE-2026-47189Quest Bot is an opensource modern Discord Bot built for mode…8.3
- CVE-2026-4719Incorrect boundary conditions in the Graphics: Text componen…7.5
- CVE-2026-47193OpenProject is open-source, web-based project management sof…7.5
- CVE-2026-47194Frappe is a full-stack web application framework. Prior to 1…8.6
- CVE-2026-47195Quest Bot is an opensource Discord Bot. Prior to version 1.1…7.1
- CVE-2026-47196Quest Bot is an opensource Discord Bot. Prior to version 1.1…8.4
- CVE-2026-47197Quest Bot is an opensource Discord Bot. Prior to version 1.1…7.2
- CVE-2026-47198Paymenter is a free and open-source webshop solution for man…8.5
Are you affected by CVE-2026-47190?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST