https://seclists.org/oss-sec/2026/q4/104: [OSSN-0110] Ironic can leak basic auth cdentials to image server
Published Oct 8, 2026
·Updated
Affected Software
1 affected component
Openstack Ironic
Deployments that use basic authentication for image retrieval and allow a deployment to set instance_info/image_source are the relevant exposure. OpenStack-integrated Ironic deployments that typically use Glance for image management are not impacted.
They need the ability to set instance_info/image_source so Ironic retrieves an image from a host under their control or another unapproved host. The issue concerns basic-auth credentials being sent to the image server.
Restrict [deploy]/image_server_auth_hosts to the approved image hosts and set [deploy]/image_server_auth_permit_unknown_hosts to False. These settings limit the hosts to which Ironic will send image-server authentication credentials.
The advisory indicates that Ironic intends to change the default of [deploy]/image_server_auth_permit_unknown_hosts to False, implying operators should not rely on the current default. Explicitly set it to False and configure an allowlist of acceptable hosts.