Vulnerabilities

TI-2025-21192 CVE-2025-29781 · GHSA-c98h-7hp9-v9hq

Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

MEDIUM 62

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00184 Published 2025-03-17 Partial fix · 0.8.1, 0.9.1 CWE-200

TI-2024-29397 CVE-2024-43803 · GHSA-pqfh-xh7w-7h3p

LOW 23

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00574 Published 2024-09-03 Fixed in 0.8.0, 0.6.2 +1 CWE-200

TI-2024-20827 CVE-2024-31463

LOW 21

Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00206 Published 2024-04-17 Partial fix · 24.1.1 CWE-288