CVE-2026-47190: Github.com/metal3 io/ip address manager IPAM Controller Service Account Granted Vulnerability
MODERATECVE-2026-47190 is a MODERATE (CVSS 4.4) ipam controller service account granted vulnerability (CWE-250: Execution with Unnecessary Privileges) affecting Github.com/metal3 io/ip address manager libraries in the Go ecosystem. The issue involves ipam controller service account granted unnecessary full access to secrets. Remediation is available by upgrading affected packages to version 1.11.7, 1.12.4.
CVE-2026-47190 at a Glance
Security Impact
CVSS: 4.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-47190
To remediate this vulnerability, upgrade all affected Github.com/metal3 io/ip address manager dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/metal3-io/ip-address-manager to 1.11.7Upgrade github.com/metal3-io/ip-address-manager to 1.12.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/metal3-io/ip-address-managerHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-47190, inspect your project dependencies for Github.com/metal3 io/ip address manager:
inspect dependencies for github.com/metal3-io/ip-address-managerAnalyze the terminal output to locate any version of Github.com/metal3 io/ip address manager in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.11.7), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-250: Execution with Unnecessary Privileges, where the product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. In Github.com/metal3 io/ip address manager, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-47190 Affected Github.com/metal3 io/ip address manager Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/metal3-io/ip-address-manager
|
Go |
< 1.11.7
|
1.11.7
|
|
github.com/metal3-io/ip-address-manager
|
Go |
≥ 1.12.0
< 1.12.4
|
1.12.4
|
References
Frequently Asked Questions
What is CVE-2026-47190?
Which Github.com/metal3 io/ip address manager versions are affected?
What version fixes CVE-2026-47190?
Is github.com/metal3-io/ip-address-manager affected?
What is the CVSS score of CVE-2026-47190?
What CWE is associated with CVE-2026-47190?
How can I check Go dependencies for CVE-2026-47190?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-49pm-43hf-6xfq",
"modified" : "2026-06-12T19:31:26Z",
"published" : "2026-05-29T18:24:45Z",
"aliases" : [ "CVE-2026-47190" ],
"summary" : "IPAM controller service account granted unnecessary full access to Secrets",
"details" : "### Impact\n\nIPAM is the IP address Manager for Cluster API Provider Metal3. The IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data.\n\nAll users running ip-address-manager versions prior to the patched releases are affected.\n\n### Patches\n\nFixed in:\n- v1.11.7\n- v1.12.4\n- v1.13.0\n\nUsers should upgrade to the patched version for their release branch.\n\n### Workarounds\n\nManually remove the Secrets resource entry from the metal3-ipam-controller-manager-role ClusterRole:\n\n```yaml\n# Remove this entire block from the ClusterRole\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - create\n - delete\n - get\n - list\n - patch\n - update\n - watch\n```\n\n### Resources\n\n- https://github.com/metal3-io/ip-address-manager/pull/1355\n- https://github.com/metal3-io/ip-address-manager/pull/1356 (backport to release-1.12)\n- https://github.com/metal3-io/ip-address-manager/pull/1357 (backport to release-1.11)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/metal3-io/ip-address-manager"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.11.7"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.11.6"
}
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/metal3-io/ip-address-manager"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.12.0"
}, {
"fixed" : "1.12.4"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.12.3"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/metal3-io/ip-address-manager/security/advisories/GHSA-49pm-43hf-6xfq"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-47190"
}, {
"type" : "WEB",
"url" : "https://github.com/metal3-io/ip-address-manager/pull/1355"
}, {
"type" : "WEB",
"url" : "https://github.com/metal3-io/ip-address-manager/pull/1356"
}, {
"type" : "WEB",
"url" : "https://github.com/metal3-io/ip-address-manager/pull/1357"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/metal3-io/ip-address-manager"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-250" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-29T18:24:45Z",
"nvd_published_at" : "2026-06-12T16:16:29Z"
}
}