Secret Leakage Vulnerability in Bare Metal Operator by Metal3

CVE-2025-29781

What is CVE-2025-29781?

The Bare Metal Operator (BMO) for Kubernetes allows users to manage bare metal hosts but has a critical flaw where users with namespace-level roles can access Secrets from unauthorized namespaces. This issue arises when creating a BMCEventSubscription, which can load Secrets from unauthorized spaces, resulting in potential Secret leakage. Although the recent patch in versions 0.8.1 and 0.9.1 restricts access to Secrets within the authorized namespace, it is crucial to replicate existing Secrets to the corresponding namespaces before upgrading. Administrators are advised to implement strict RBAC controls and configuration options to prevent unauthorized access, safeguarding sensitive information in their environments.

References