Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-29781US | — | — | ||
The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon de… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94cWEB
- https://github.com/metal3-io/baremetal-operator/pull/2321WEB
- https://github.com/metal3-io/baremetal-operator/pull/2322WEB
- https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hqADVISORY
- https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.mdWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan