-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/metal3-io/baremetal-operator | go | >= 0.7.0-rc.0, < 0.8.0 | 0.8.0 |
| github.com/metal3-io/baremetal-operator | go | >= 0.6.0, < 0.6.2 | 0.6.2 |
| github.com/metal3-io/baremetal-operator | go | < 0.5.2 | 0.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from BMO's ability to read Secrets from any namespace when processing BareMetalHost resources. The key function responsible for fetching secret data (getSecretData in host_config_data.go) lacked namespace validation in vulnerable versions. The patch adds an explicit check comparing the secret's namespace with the host's namespace, which is visible in the commit diff for host_config_data.go. The test cases added in host_config_data_test.go validate this behavior by testing cross-namespace secret references, confirming this was the attack vector. The function's role in secret retrieval and the missing namespace check directly map to the vulnerability description.
A Semantic Attack on Google Gemini - Read the Latest Research