tocsin

CVE-2025-29781

2 advisories.

Go/github.com/metal3-io/baremetal-operator/apis CVE-2025-29781: medium 6.5, EPSS 0.18%

Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

Action: Upgrade github.com/metal3-io/baremetal-operator/apis to 0.8.1 or later.

go get github.com/metal3-io/baremetal-operator/apis@v0.9.1
go get github.com/metal3-io/baremetal-operator/apis@v0.8.1

Affected

introducedfixedlast affected
0.9.00.9.1-
00.8.1-

Fixed versions

0.9.10.8.1

Sources

CVE-2025-29781 · published · modified · JSON

Go/github.com/metal3-io/baremetal-operator/apis CVE-2025-29781: unknown, EPSS 0.18%

Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis

Action: Upgrade github.com/metal3-io/baremetal-operator/apis to 0.8.1 or later.

go get github.com/metal3-io/baremetal-operator/apis@v0.8.1
go get github.com/metal3-io/baremetal-operator/apis@v0.9.1

Affected

introducedfixedlast affected
00.8.1-
0.9.00.9.1-

Fixed versions

0.8.10.9.1

Sources

CVE-2025-29781 · published · modified · JSON