PT-2025-11560

Name of the Vulnerable Software and Affected Versions Bare Metal Operator versions prior to 0.8.1 Bare Metal Operator versions prior to 0.9.1 Description The issue allows an adversary with namespace-level roles to create a BMCEventSubscription and load Secrets from unauthorized namespaces, causin...

CVE-2025-29781: Exposure of Sensitive Information to an Unauthorized Actor

The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource BMCEventSubscription. Prior to versions 0.8.1 and 0.9.1, an adversary...