What is GHSA-hfc8-w5f4-3x6m?

GHSA-hfc8-w5f4-3x6m is a security advisory published by GitHub Security Advisories with Medium severity. Ironic Standalone Operator's controller modifies user-owned resources without consent

Why does GHSA-hfc8-w5f4-3x6m have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-hfc8-w5f4-3x6m?

GHSA-hfc8-w5f4-3x6m has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hfc8-w5f4-3x6m?

GHSA-hfc8-w5f4-3x6m affects 2 products, including: go/github.com/metal3-io/ironic-standalone-operator:\u003c= 0.7.2; go/github.com/metal3-io/ironic-standalone-operator:\u003e= 0.8.0, \u003c= 0.8.1.

GHSA-hfc8-w5f4-3x6mMediumCVSS 4.3Disclosed before NVD

Ironic Standalone Operator's controller modifies user-owned resources without consent

Vendor

GitHub Security Advisories

Published

May 29, 2026

Last Modified

May 29, 2026

📋 Description

Impact

The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.

Patches

Fixed in v0.9.0, v0.8.2, v0.7.3.

Workarounds

Manually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.

Resources

https://github.com/metal3-io/ironic-standalone-operator/pull/619
https://github.com/metal3-io/ironic-standalone-operator/pull/664
https://github.com/metal3-io/ironic-standalone-operator/pull/665

🎯 Affected products2

go/github.com/metal3-io/ironic-standalone-operator:<= 0.7.2
go/github.com/metal3-io/ironic-standalone-operator:>= 0.8.0, <= 0.8.1