Vulnerability Description
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Metal3 | Ip-Address-Manager | >= 1.11.0, < 1.11.7 |
Related Weaknesses (CWE)
References
- https://github.com/metal3-io/ip-address-manager/pull/1355Issue TrackingPatch
- https://github.com/metal3-io/ip-address-manager/pull/1356Issue TrackingPatch
- https://github.com/metal3-io/ip-address-manager/pull/1357Issue TrackingPatch
- https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43MitigationVendor Advisory
FAQ
What is CVE-2026-47190?
CVE-2026-47190 is a vulnerability with a CVSS score of 4.4 (MEDIUM). IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list...
How severe is CVE-2026-47190?
CVE-2026-47190 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47190?
Check the references section above for vendor advisories and patch information. Affected products include: Metal3 Ip-Address-Manager.