{"id":"CVE-2023-30841","aliases":["EUVD-2023-1258","GHSA-9wh7-397j-722m"],"status":"published","title":"Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps","description":"Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00191,"percentile":0.08813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-319"],"published":"2023-04-26T18:24:04Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"Go","package":"github.com/metal3-io/baremetal-operator","fixed_in":["0.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/metal3-io/baremetal-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/metal3-io/baremetal-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}]}],"products":[{"vendor":"linuxfoundation","product":"baremetal_operator"},{"vendor":"metal3-io","product":"baremetal-operator"}],"references":[{"url":"https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/metal3-io/baremetal-operator/pull/1241","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30841","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9wh7-397j-722m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30841.json","tags":["advisory"]},{"url":"https://github.com/metal3-io/baremetal-operator","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30841","title":"Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps","description":"Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.","status":"published","published":"2023-04-26T18:24:04.479Z","modified":"2025-01-30T21:30:50.655Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-1258","description":"Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.","status":"published","published":"2023-04-26T18:24:04Z","modified":"2025-01-30T21:30:50Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:08.578338Z"}],"ghsa":[{"id":"GHSA-9wh7-397j-722m","title":"Ironic and ironic-inspector may expose as ConfigMaps","description":"### Impact\nIronic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage.\n\n### Patches\nThis issue is patched in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241), and is included in BMO release 0.3.0 onwards.\n\n### Workarounds\nUser may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241)\n","status":"published","published":"2023-04-26T19:46:00Z","modified":"2023-11-07T05:05:53Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T14:37:15.931647Z"}],"nvd":[{"id":"CVE-2023-30841","description":"Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.","status":"published","published":"2023-04-26T19:15:09.14Z","modified":"2026-06-17T05:55:45.04Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T14:07:59.151142Z"}],"osv":[{"id":"CVE-2023-30841","title":"Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps","description":"Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.","status":"published","published":"2023-04-26T18:24:04.479Z","modified":"2026-10-28T02:30:20.894315231Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-9wh7-397j-722m","title":"Ironic and ironic-inspector may expose as ConfigMaps","description":"### Impact\nIronic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage.\n\n### Patches\nThis issue is patched in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241), and is included in BMO release 0.3.0 onwards.\n\n### Workarounds\nUser may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241)\n","status":"published","published":"2023-04-26T19:46:00Z","modified":"2023-11-08T04:12:27.263669Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}