GHSA-hfc8-w5f4-3x6m
Ironic Standalone Operator's controller modifies user-owned resources without consent
Impact
The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.
Patches
Fixed in v0.9.0, v0.8.2, v0.7.3.
Workarounds
Manually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.
Resources
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Ironic Standalone Operator's controller modifies user-owned resources without consent
Impact
The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.
Patches
Fixed in v0.9.0, v0.8.2, v0.7.3.
Workarounds
Manually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.
Resources
- Record
GHSA-hfc8-w5f4-3x6m- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Ironic Standalone Operator's controller modifies user-owned resources without consent
Impact
The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.
Patches
Fixed in v0.9.0, v0.8.2, v0.7.3.
Workarounds
Manually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.
Resources
- Record
GHSA-hfc8-w5f4-3x6m- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGO-2026-5425No score
Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator
Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator
- Record
GO-2026-5425- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/metal3-io/ironic-standalone-operatorGo | through 0.7.2 | 0.7.3 |
github.com/metal3-io/ironic-standalone-operatorGo | 0.8.0 to 0.8.1 | 0.8.2 |
github.com/metal3-io/ironic-standalone-operatorGo | before 0.7.3 | 0.7.3 |
github.com/metal3-io/ironic-standalone-operatorGo | 0.8.0 up to 0.8.2 | 0.8.2 |
github.com/metal3-io/ironic-standalone-operatorGo | before 0.7.3, 0.8.0 up to 0.8.2 | 0.7.30.8.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-hfc8-w5f4-3x6m is a medium vulnerability (CVSS 4.3) in github.com/metal3-io/ironic-standalone-operator, published May 29, 2026. No source lists public exploit code. Fixed in github.com/metal3-io/ironic-standalone-operator 0.7.3.
References
github.com/metal3-io/ironic-standalone-operator/security/advisories/GHSA-hfc8-w5f4-3x6m