{"id":"EUVD-2026-36463","revision":"7b486dca5fd94ffe8220942cc2929ebd","records":[{"revision":"7b486dca5fd94ffe8220942cc2929ebd","observedAt":"2026-11-05T10:05:18.62+00:00","statement":{"source":"euvd","id":"EUVD-2026-36463","aliases":["CVE-2026-47190","GHSA-49pm-43hf-6xfq"],"title":"IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secre…","description":"IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.4,"severity":null}],"references":["https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq","https://github.com/metal3-io/ip-address-manager/pull/1355","https://github.com/metal3-io/ip-address-manager/pull/1356","https://github.com/metal3-io/ip-address-manager/pull/1357"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36463","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 12, 2026, 2:49:51 PM","dateUpdated":"Jun 13, 2026, 3:18:15 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36463","identifiers":["EUVD-2026-36463","CVE-2026-47190","GHSA-49pm-43hf-6xfq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}