GHSA-hfc8-w5f4-3x6m Ironic Standalone Operator's controller modifies user-owned resources without consent
The Ironic Standalone Operator controller modifies user-owned Secrets and ConfigMaps without consent, violating resource integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hfc8-w5f4-3x6m?
GHSA-hfc8-w5f4-3x6m is a missing authorization vulnerability in github.com/metal3-io/ironic-standalone-operator, published on 29 May 2026.
Official description
Impact
The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources constitutes an unauthorized integrity violation. Deployments running IrSO v0.7.0 through v0.8.1 that reference user-provided Secrets or ConfigMaps (TLS certificates, BMC CA, trusted CA) are affected.
Patches
Fixed in v0.9.0, v0.8.2, v0.7.3.
Workarounds
Manually add the environment label (ironic-standalone-operator.metal3.io/environment) to all user-provided Secrets and ConfigMaps before they are referenced in the Ironic resource. This prevents the controller from modifying them.
Resources
Which versions are affected by GHSA-hfc8-w5f4-3x6m?
5 open source packages ship an affected version, including github.com/metal3-io/ironic-standalone-operator.
| Package | Affected | Fixed in |
|---|---|---|
github.com/metal3-io/ironic-standalone-operator Go | All versions | 0.7.3, 0.8.2 |
github.com/metal3-io/ironic-standalone-operator Go | All versions | 0.7.3 |
github.com/metal3-io/ironic-standalone-operator Go | All versions | 0.7.3 |
github.com/metal3-io/ironic-standalone-operator Go | From 0.8.0 | 0.8.2 |
github.com/metal3-io/ironic-standalone-operator Go | From 0.8.0 | 0.8.2 |
How do I fix GHSA-hfc8-w5f4-3x6m?
Upgrade github.com/metal3-io/ironic-standalone-operator to a fixed version for your release line: 0.7.3 or 0.8.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-hfc8-w5f4-3x6m being exploited?
There is no known exploitation of GHSA-hfc8-w5f4-3x6m in the wild and no public exploit code.
Sources
Also known as GO-2026-5425.