https://seclists.org/oss-sec/2026/q4/104: [OSSN-0110] Ironic can leak basic auth cdentials to image server
Affected Software
Frequently Asked Questions
Which deployments are most likely to be exposed?
Deployments that use basic authentication for image retrieval and allow a deployment to set instance_info/image_source are the relevant exposure. OpenStack-integrated Ironic deployments that typically use Glance for image management are not impacted.
What must an attacker be able to control to obtain credentials?
They need the ability to set instance_info/image_source so Ironic retrieves an image from a host under their control or another unapproved host. The issue concerns basic-auth credentials being sent to the image server.
What configuration should be used if patching cannot happen immediately?
Restrict [deploy]/image_server_auth_hosts to the approved image hosts and set [deploy]/image_server_auth_permit_unknown_hosts to False. These settings limit the hosts to which Ironic will send image-server authentication credentials.
Are installations safe with the existing default configuration?
The advisory indicates that Ironic intends to change the default of [deploy]/image_server_auth_permit_unknown_hosts to False, implying operators should not rely on the current default. Explicitly set it to False and configure an allowlist of acceptable hosts.