x/vulndb: potential Go vuln in github.com/metal3-io/baremetal-operator/apis: GHSA-c98h-7hp9-v9hq

[GoVulnBot]

Advisory GHSA-c98h-7hp9-v9hq references a vulnerability in the following Go modules:

Module
github.com/metal3-io/baremetal-operator/apis

Description:

Impact

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3.

Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource BMCEventSubscription (BMCES). An adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a BMCES in their authorized namespace and then load Secrets from their unauthorized namespaces to their authorized namespace via the Baremetal Operator controller's cluster scoped privileges, causing Secret lea...

References:

• ADVISORY: GHSA-c98h-7hp9-v9hq
• ADVISORY: GHSA-c98h-7hp9-v9hq
• FIX: metal3-io/baremetal-operator@19f8443
• FIX: ⚠️ Only accept HTTPHeadersRef in same namespace metal3-io/baremetal-operator#2321
• FIX: ⚠️ Only accept HTTPHeadersRef in same namespace metal3-io/baremetal-operator#2322
• WEB: https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/metal3-io/baremetal-operator/apis
      non_go_versions:
        - introduced: TODO (earliest fixed "0.8.1", vuln range "<= 0.8.0")
        - introduced: TODO (earliest fixed "0.9.1", vuln range "= 0.9.0")
      vulnerable_at: 0.9.1
summary: |-
    Bare Metal Operator (BMO) can expose any secret from other namespaces via
    BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
cves:
    - CVE-2025-29781
ghsas:
    - GHSA-c98h-7hp9-v9hq
references:
    - advisory: https://github.com/advisories/GHSA-c98h-7hp9-v9hq
    - advisory: https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq
    - fix: https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c
    - fix: https://github.com/metal3-io/baremetal-operator/pull/2321
    - fix: https://github.com/metal3-io/baremetal-operator/pull/2322
    - web: https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md
notes:
    - fix: 'module merge error: could not merge versions of module github.com/metal3-io/baremetal-operator/apis: invalid or non-canonical semver version (found TODO (earliest fixed "0.8.1", vuln range "<= 0.8.0"))'
source:
    id: GHSA-c98h-7hp9-v9hq
    created: 2025-03-17T22:01:12.654294146Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/658855 mentions this issue: data/reports: add 4 reports