Metal3-Io
6 CVEs across 3 Metal3-Io products. Browse Metal3-Io vulnerabilities, severities, and proof-of-concept exploits.
Metal3-Io products with known CVEs
Metal3-Io CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-47190 | Medium | 4.4 | 2026-06-12 | IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CR… |
CVE-2025-29781 | Medium | 6.5 | 2025-03-17 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitra… |
CVE-2024-43803 | Medium | 4.9 | 2024-09-03 | The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaDa… |
CVE-2024-31463 | Medium | 4.7 | 2024-04-17 | Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` va… |
CVE-2023-40585 | High | 7.3 | 2023-08-25 | ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not… |
CVE-2023-30841 | Medium | 6.0 | 2023-04-26 | Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Bare… |