metal3-io vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20242
3. 20251
4. 20261

Newest CVEs

• CVE-2026-47190

  IPAM controller service account granted unnecessary full access to Secrets

  metal3-io · ip-address-manager

  Medium4.4
• CVE-2025-29781

  Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

  metal3-io · baremetal-operator

  Medium6.5
• CVE-2024-43803

  BMO can expose particularly named secrets from other namespaces via BMH CRD

  metal3-io · baremetal-operator

  Medium4.9
• CVE-2024-31463

  Ironic-image allows unauthenticated local access to Ironic API

  metal3-io · ironic-image

  Medium4.7
• CVE-2023-40585

  Unauthenticated access to Ironic API

  metal3-io · ironic-image

  High7.3
• CVE-2023-30841

  Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps

  metal3-io · baremetal-operator

  Medium6.0