Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/metal3-io/ironic-standalone-operator
  4. ›
  5. GHSA-7cwm-fpfh-rrch

GHSA-7cwm-fpfh-rrch: Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces

May 29, 2026

The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. The Prometheus metrics exporter binds to 0.0.0.0 (all network interfaces) by default with no authentication. The default config is disabled. If enabled, this exposes operational metrics to any host on adjacent networks. Deployments running IrSO v0.7.0 through v0.8.1 with the Prometheus exporter enabled are affected. Versions prior to v0.7.0 do not have the Prometheus exporter feature.

References

  • github.com/advisories/GHSA-7cwm-fpfh-rrch
  • github.com/metal3-io/ironic-standalone-operator/pull/635
  • github.com/metal3-io/ironic-standalone-operator/security/advisories/GHSA-7cwm-fpfh-rrch

Code Behaviors & Features

Detect and mitigate GHSA-7cwm-fpfh-rrch with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.9.0

Fixed versions

  • 0.9.0

Solution

Upgrade to version 0.9.0 or above.

Impact 4.3 MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-668: Exposure of Resource to Wrong Sphere

Source file

go/github.com/metal3-io/ironic-standalone-operator/GHSA-7cwm-fpfh-rrch.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 23 Jun 2026 12:24:55 +0000.