Read the docs
TI-2023-14621 Aliases CVE-2023-30841GHSA-9wh7-397j-722m

Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps

Priority LOW 26CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial baremetal-operator (metal3-io): 0.3.0github.com/metal3-io/baremetal-operator (Go): 0.3.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
metal3-iobaremetal-operatorbefore 0.3.00.3.0Patch availableCNA
—github.com/metal3-io/baremetal-operator (Go)before 0.3.00.3.0Patch availableGHSA-9wh7-397j-722m
  • baremetal-operator Vendormetal3-io Affected before 0.3.0 Fixed in 0.3.0 Patch available CNA
  • github.com/metal3-io/baremetal-operator (Go) Vendor— Affected before 0.3.0 Fixed in 0.3.0 Patch available GHSA-9wh7-397j-722m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:baremetal_operator:*:*:*:*:*:*:*:*before 0.3.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:baremetal_operator:*:*:*:*:*:*:*:* Versions before 0.3.0 Vulnerable ·backstage

Remediation

  • Fix · CNA baremetal-operator (metal3-io) Fixed in 0.3.0
  • Fix · GHSA-9wh7-397j-722m github.com/metal3-io/baremetal-operator (Go) Fixed in 0.3.0 Advisory →

Red Hat 3 advisories

  • RHSA-2024:3801 Released 2024-06-11 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.58 CNF vRAN extras security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/topology-aware-lifecycle-manager-operator-bundle, openshift4/topology-aware-lifecycle-manager-precache-rhel8, openshift4/topology-aware-lifecycle-manager-recovery-rhel8 +2
  • RHSA-2023:6143 Released 2023-10-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 CNF vRAN extras security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/bare-metal-event-relay-rhel8-operator, openshift4/topology-aware-lifecycle-manager-rhel8-operator
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Openshift Data Foundation 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:3801
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1326
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:6143
Not affected: 4 products
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform Assisted Installer 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30841
  2. 2026-10-03 Alias added: GHSA-9wh7-397j-722m

References

Exploit 1

Advisory 2

Other 1

  • TI-2025-21192 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD CVSS 3.1MEDIUM 6.5
  • TI-2024-29397 BMO can expose particularly named secrets from other namespaces via BMH CRD CVSS 3.1MEDIUM 4.9
  • TI-2024-20827 Ironic-image allows unauthenticated local access to Ironic API CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences