CVE-2025-44021: OSSA-2025-001 / CVE-2025-44021: OpenStack Ironic fails to strict paths used for file:// image URLs
First published: Thu May 08 2025(Updated: )
OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Ironic | <29.0.1 | |
| pip/ironic | >=27.0.0<29.0.1 | 29.0.1 |
| pip/ironic | >=25.0.0<26.1.1 | 26.1.1 |
| pip/ironic | <24.1.3 | 24.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.launchpad.net/ironic/+bug/2107847
- https://security.openstack.org/ossa/OSSA-2025-001.html
- http://www.openwall.com/lists/oss-security/2025/05/08/1
- https://nvd.nist.gov/vuln/detail/CVE-2025-44021
- https://github.com/openstack/ironic/commit/10590b36f541130f6a5d7a49da0f095ff8390cce
- https://github.com/pypa/advisory-database/tree/main/vulns/ironic/PYSEC-2025-38.yaml
- https://github.com/advisories/GHSA-q3m2-crgq-5p3q (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-44021?
CVE-2025-44021 is a high-severity vulnerability that allows unintended file writing during image handling in OpenStack Ironic.
How do I fix CVE-2025-44021?
To mitigate CVE-2025-44021, upgrade OpenStack Ironic to version 29.0.1 or later.
What are the affected versions of OpenStack Ironic for CVE-2025-44021?
CVE-2025-44021 affects OpenStack Ironic versions prior to 29.0.1.
What can happen if CVE-2025-44021 is exploited?
If exploited, CVE-2025-44021 can allow a malicious project to write undesirable files to a target node's disk.
How can I determine if my system is affected by CVE-2025-44021?
You can determine if your system is affected by checking the version of OpenStack Ironic; if it's below 29.0.1, you're at risk.
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-44021
- agent/title
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- agent/softwarecombine
- agent/event
- agent/trending
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-q3m2-crgq-5p3q
- agent/references
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/openstack
- canonical/openstack ironic
- package-manager/pip