—
GO-2025-3530
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Quick fix
GO-2025-3530 — github.com/metal3-io/baremetal-operator/apis: upgrade to the fixed version with the command below.
go get github.com/metal3-io/baremetal-operator/apis@v0.8.1Details
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/metal3-io/baremetal-operator/apis
Introduced in:
0Fixed in: 0.8.1Fix
go get github.com/metal3-io/baremetal-operator/apis@v0.8.1References
- https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq[ADVISORY]
- https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c[WEB]
- https://github.com/metal3-io/baremetal-operator/pull/2321[WEB]
- https://github.com/metal3-io/baremetal-operator/pull/2322[WEB]
- https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md[WEB]