Vendor

    Metal3-io

    6 known vulnerabilities in products by Metal3-io, 0 of them actively exploited (CISA KEV).

    Key figures

    6

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Metal3-io
    HighCVE-2023-40585

    Unauthenticated access to Ironic API

    		7.3
    MediumCVE-2024-43803

    BMO can expose particularly named secrets from other namespaces via BMH CRD

    also in 1 other product

    		4.9
    MediumCVE-2026-47190

    IPAM controller service account granted unnecessary full access to Secrets

    also in 1 other product

    		4.4
    MediumCVE-2025-29781

    Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

    also in 1 other product

    		6.5
    MediumCVE-2023-30841

    Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps

    also in 2 other products

    		6.0
    MediumCVE-2024-31463

    Ironic-image allows unauthenticated local access to Ironic API

    		4.7

    Products

    Products by Metal3-io
    Baremetal-operator30