CVE-2026-44916: [OSSA-2026-012] Ironic: mote Code Execution when Anaconda driver enabled (CVE-2026-44916)
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instanceinfo['kstemplate'] is rendered without sandboxing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Ironicto a version that resolves this vulnerability.Fixed in 35.0.2 - Configuration
Disable the Anaconda driver (set its enabled flag to false or remove it from enabled drivers) to avoid rendering instance_info['ks_template'] without sandboxing when the driver is not required.
OpenStack Ironic (Anaconda driver) enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44916?
CVE-2026-44916 is considered a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2026-44916?
To fix CVE-2026-44916, upgrade to a version of OpenStack Ironic that is beyond 35.x, where the vulnerability is resolved.
What are the impacts of CVE-2026-44916?
The impacts of CVE-2026-44916 include potential unauthorized access and execution of malicious code on affected systems.
Who is affected by CVE-2026-44916?
CVE-2026-44916 affects users of OpenStack Ironic versions up to and including 35.x.
What is the vulnerability type for CVE-2026-44916?
CVE-2026-44916 is a code injection vulnerability caused by the rendering of instance_info['ks_template'] without proper sandboxing.