The IP Address Manager (IPAM) controller’s ClusterRole in metal3-io’s IPAM was granted full Create, Read, Update, Delete, Patch, and Watch permissions on core/v1 Secrets, even though the controller never accesses these resources during normal operation. If an attacker compromises the controller pod—through a supply‑chain intrusion, container escape, or other method—they can read, modify, or delete Secrets in the namespace. This allows disclosure of credentials, configuration data, or other sensitive information that could facilitate further attacks or disrupt cluster operations.

metal3-io IP Address Manager (IPAM) versions prior to 1.11.7, 1.12.4, and 1.13.0 are affected. The vulnerability has been resolved in these versions and later releases.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is low under current conditions. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to require a compromise of the controller pod, which could occur via a supply‑chain attack or container escape. Once compromised, the attacker can use the over‑privileged role to read, modify, or delete Secrets, potentially exposing sensitive data and enabling further malicious activity.