4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7cwm-fpfh-rrch

GHSA-7cwm-fpfh-rrch: Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces

Impact

The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. The Prometheus metrics exporter binds to 0.0.0.0 (all network interfaces) by default with no authentication. The default config is disabled. If enabled, this exposes operational metrics to any host on adjacent networks. Deployments running IrSO v0.7.0 through v0.8.1 with the Prometheus exporter enabled are affected. Versions prior to v0.7.0 do not have the Prometheus exporter feature.

Patches

The exporter now exposes a configurable bindAddress field. Users should upgrade to v0.9.0 or later.

Workarounds

Users on older versions than v0.9.0 should use host-level firewall rules (iptables/nftables) to restrict access to the metrics port from unintended networks, or disable the metrics service.

Resources

https://github.com/metal3-io/ironic-standalone-operator/pull/635

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7cwm-fpfh-rrch

GHSA-7cwm-fpfh-rrch:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/metal3-io/ironic-standalone-operator	go	< 0.9.0	0.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the Prometheus metrics exporter, which is a Flask application, binds to all network interfaces (0.0.0.0) by default, exposing sensitive metrics. The root cause is the lack of configuration specifying a secure bind address for the exporter container.

The analysis of the provided patches pinpoints the newPrometheusExporterContainer function in pkg/ironic/containers.go as the source of the vulnerability. This function is responsible for defining the container specification for the Prometheus exporter. In the vulnerable versions, this function did not set the FLASK_RUN_HOST environment variable. The absence of this variable caused the underlying Flask application to use its default behavior of binding to 0.0.0.0.

The patch rectifies this by modifying newPrometheusExporterContainer to set the FLASK_RUN_HOST environment variable. Initially, it's hardcoded to 127.0.0.1 for security, and a subsequent commit makes this configurable through the Ironic CRD by adding a bindAddress field, which is then read by the newPrometheusExporterContainer function. Therefore, ironic.newPrometheusExporterContainer is the function that contains the vulnerability, as its failure to properly configure the container leads to the insecure exposure of the metrics endpoint.

Vulnerable functions

ironic.newPrometheusExporterContainer

pkg/ironic/containers.go

This function is responsible for configuring and creating the Prometheus exporter container. In vulnerable versions, this function did not set the `FLASK_RUN_HOST` environment variable for the container. This caused the Flask-based exporter to bind to `0.0.0.0` by default, exposing the metrics endpoint on all network interfaces of the host when `hostNetwork: true` is used. This allows unauthorized access to potentially sensitive operational metrics from adjacent networks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.