{"id":"GHSA-hfc8-w5f4-3x6m","aliases":["GO-2026-5425"],"status":"published","title":"Ironic Standalone Operator's controller modifies user-owned resources without consent","description":"## Impact\n\nThe Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.\n\n## Patches\n\nFixed in v0.9.0, v0.8.2, v0.7.3. \n\n## Workarounds\n\nManually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.\n\n## Resources\n\n- https://github.com/metal3-io/ironic-standalone-operator/pull/619\n- https://github.com/metal3-io/ironic-standalone-operator/pull/664\n- https://github.com/metal3-io/ironic-standalone-operator/pull/665","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-05-29T18:23:34Z","modified":"2026-06-25T23:11:48Z","fixes":[{"ecosystem":"Go","package":"github.com/metal3-io/ironic-standalone-operator","fixed_in":["0.7.3","0.8.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/metal3-io/ironic-standalone-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.2"},{"fixed":"0.7.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/metal3-io/ironic-standalone-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"last_affected":"0.8.1"},{"fixed":"0.8.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/metal3-io/ironic-standalone-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/metal3-io/ironic-standalone-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"0.8.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/metal3-io/ironic-standalone-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.3"},{"introduced":"0.8.0"},{"fixed":"0.8.2"}]}]}],"references":[{"url":"https://github.com/metal3-io/ironic-standalone-operator/security/advisories/GHSA-hfc8-w5f4-3x6m","tags":["web","advisory"]},{"url":"https://github.com/metal3-io/ironic-standalone-operator/pull/619","tags":["web","fix"]},{"url":"https://github.com/metal3-io/ironic-standalone-operator/pull/664","tags":["web","fix"]},{"url":"https://github.com/metal3-io/ironic-standalone-operator/pull/665","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-hfc8-w5f4-3x6m"},{"url":"https://github.com/metal3-io/ironic-standalone-operator","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hfc8-w5f4-3x6m","title":"Ironic Standalone Operator's controller modifies user-owned resources without consent","description":"## Impact\n\nThe Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.\n\n## Patches\n\nFixed in v0.9.0, v0.8.2, v0.7.3. \n\n## Workarounds\n\nManually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.\n\n## Resources\n\n- https://github.com/metal3-io/ironic-standalone-operator/pull/619\n- https://github.com/metal3-io/ironic-standalone-operator/pull/664\n- https://github.com/metal3-io/ironic-standalone-operator/pull/665","status":"published","published":"2026-05-29T18:23:34Z","modified":"2026-05-29T18:23:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:40:14.666177Z"}],"osv":[{"id":"GHSA-hfc8-w5f4-3x6m","title":"Ironic Standalone Operator's controller modifies user-owned resources without consent","description":"## Impact\n\nThe Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.\n\n## Patches\n\nFixed in v0.9.0, v0.8.2, v0.7.3. \n\n## Workarounds\n\nManually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.\n\n## Resources\n\n- https://github.com/metal3-io/ironic-standalone-operator/pull/619\n- https://github.com/metal3-io/ironic-standalone-operator/pull/664\n- https://github.com/metal3-io/ironic-standalone-operator/pull/665","status":"published","published":"2026-05-29T18:23:34Z","modified":"2026-06-25T23:11:48.977423936Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"GO-2026-5425","title":"Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator","description":"Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator","status":"published","published":"2026-06-25T22:34:31Z","modified":"2026-06-25T23:01:13.026420581Z","updated_at":"2026-11-02T15:47:02.556545Z"}]}}