Executive brief
The IP Address Manager (IPAM) for Cluster API Provider Metal3, which manages IP addresses for bare-metal Kubernetes clusters, was found to have excessive permissions. The software was granted full access to sensitive system secrets that it does not actually need to function. If the system were partially compromised through other means, an attacker could exploit these extra permissions to steal credentials or sensitive data, potentially leading to broader unauthorized access.
Technical details
The IPAM controller's ClusterRole incorrectly included a policy rule granting 'create', 'delete', 'get', 'list', 'patch', 'update', and 'watch' permissions on core/v1 Secrets, despite the controller not requiring Secret access for normal operations. This is a violation of the principle of least privilege (CWE-250). An attacker who achieves a foothold in the controller pod (e.g., via a container escape or supply chain attack) could leverage the service account's excessive RBAC permissions to exfiltrate or modify sensitive data within the namespace. The vulnerability is reachable over the network but requires high privileges and high attack complexity. The issue has been resolved by removing the unused RBAC markers and dead code in versions 1.11.7, 1.12.4, and 1.13.0.
Affected products
- metal3-io ip-address-manager <= 1.11.6, <= 1.12.3, < 1.13.0
Timeline
- 2026-03-25: other: Initial fix submitted via pull request
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD