一、 漏洞 CVE-2025-29781 基础信息
漏洞标题
裸金属操作员（BMO）可以通过BMCEventSubscription CRD暴露来自其他命名空间的任何秘密
来源：AIGC 神龙大模型
漏洞描述信息
N/A
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
来源：AIGC 神龙大模型
漏洞类别
关键资源的不正确权限授予
来源：AIGC 神龙大模型
漏洞标题
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD
来源：美国国家漏洞数据库 NVD
漏洞描述信息
The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventSubscription`. Prior to versions 0.8.1 and 0.9.1, an adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a `BMCEventSubscription` in his authorized namespace and then load Secrets from his unauthorized namespaces to his authorized namespace via the Baremetal Operator, causing Secret Leakage. The patch makes BMO refuse to read Secrets from other namespace than where the corresponding BMH resource is. The patch does not change the `BMCEventSubscription` API in BMO, but stricter validation will fail the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES CR has already been deployed. The issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by `BMCEventSubscription`'s `httpHeadersRef` to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets. As a workaround, the operator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use `WATCH_NAMESPACE` configuration option to limit BMO to single namespace.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
来源：美国国家漏洞数据库 NVD
漏洞类别
信息暴露
来源：美国国家漏洞数据库 NVD
漏洞标题
Bare Metal Operator 安全漏洞
来源：中国国家信息安全漏洞库 CNNVD
漏洞描述信息
Bare Metal Operator是Metal3开源的一个应用程序，用Kubernetes API来管理裸机主机。 Bare Metal Operator 0.8.1和0.9.1之前版本存在安全漏洞，该漏洞源于访问控制不当，可能导致秘密泄露。
来源：中国国家信息安全漏洞库 CNNVD
CVSS信息
N/A
来源：中国国家信息安全漏洞库 CNNVD
漏洞类别
其他
来源：中国国家信息安全漏洞库 CNNVD
二、漏洞 CVE-2025-29781 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2025-29781 的情报信息

  • 标题： :warning: Only accept HTTPHeadersRef in same namespace by tuminoid · Pull Request #2321 · metal3-io/baremetal-operator · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    :warning: Only accept HTTPHeadersRef in same namespace by tuminoid · Pull Request #2321 · metal3-io/baremetal-operator · GitHub

  • 标题： :warning: Only accept HTTPHeadersRef in same namespace by tuminoid · Pull Request #2322 · metal3-io/baremetal-operator · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    :warning: Only accept HTTPHeadersRef in same namespace by tuminoid · Pull Request #2322 · metal3-io/baremetal-operator · GitHub

  • 标题： BMO can expose any secret from other namespaces via BMCEventSubscription CRD · Advisory · metal3-io/baremetal-operator · GitHub -- 🔗来源链接

    标签： x_refsource_CONFIRM

    BMO can expose any secret from other namespaces via BMCEventSubscription CRD · Advisory · metal3-io/baremetal-operator · GitHub

  • 标题： metal3-docs/design/baremetal-operator/bmc-events.md at main · metal3-io/metal3-docs · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    metal3-docs/design/baremetal-operator/bmc-events.md at main · metal3-io/metal3-docs · GitHub

  • 标题： Merge commit from fork · metal3-io/baremetal-operator@19f8443 · GitHub -- 🔗来源链接

    标签： x_refsource_MISC

    Merge commit from fork · metal3-io/baremetal-operator@19f8443 · GitHub
  • https://nvd.nist.gov/vuln/detail/CVE-2025-29781