metal3-io

Products

Product	CVEs	Exploited	Latest
baremetal-operator	3	–	Mar 17, 2025
ironic-image	2	–	Apr 17, 2024
ip-address-manager	1	–	Jun 12, 2026

CVE-2026-47190 Medium 4.4 IPAM controller service account granted unnecessary full access to Secrets 0.3%
CVE-2025-29781 Medium 6.5 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD 0.2%
CVE-2024-43803 Medium 4.9 BMO can expose particularly named secrets from other namespaces via BMH CRD 0.6%
CVE-2024-31463 Medium 4.7 Ironic-image allows unauthenticated local access to Ironic API 0.2%
CVE-2023-40585 High 7.3 Unauthenticated access to Ironic API 0.4%
CVE-2023-30841 Medium 6.0 Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps 0.2%