OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service.
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. This is tracked as bug #2150256.
======================================================================== OSSA-2026-048: Ironic allows generic node update for maintenance setting ========================================================================
:Date: October 22, 2026 :CVE: CVE-2026-89419
Affects ~~~~~~~ Description ~~~~~~~~~~~ The Metal3.io Security team reported a vulnerability in Ironic's API. When calling the Node maintenance API at /v1/nodes/{ident}/maintenance, Ironic properly applies the baremetal:node:setmaintenance and baremetal:node:clearmaintenance policies.
However, if a user instead calls the more generic Node update API by sending an HTTP PATCH to /v1/nodes/{ident}, and includes maintenance or maintenancereason in the dictionary, they can instead trigger the baremetal:node:update policy. This may lead to users unexpectedly having access to change the maintenance setting on a node.
For clouds using default Ironic policy, this means someone with the member role on the project indicated in node.lessee can change maintenance on the node. This is typically restricted only to accounts with manager or admin roles on lessee accounts. There is no change in effective default permissions in the case of node.owner project members or system-scoped users.
Patches ~~~~~~~ - https://review.opendev.org/1011871 (2024.1/caracal (unmaintained)) - https://review.opendev.org/1011869 (2025.1/epoxy) - https://review.opendev.org/1011867 (2025.2/flamingo) - https://review.opendev.org/1011865 (2026.1/gazpacho) - https://review.opendev.org/1011863 (2026.2/hibiscus) - https://review.opendev.org/1011861 (2027.1/indri (development)) - https://review.opendev.org/1011875 (Bugfix/37.0) - https://review.opendev.org/1011873 (Bugfix/38.0)
Credits ~~~~~~~ - Dmitry Tantsur, Metal3.io Security Team from Red Hat (CVE-2026-89419)
References ~~~~~~~~~~ - https://launchpad.net/bugs/2166510 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89419
Notes ~~~~~ - Patches for unmaintained/2024.1, bugfix/38.0, and bugfix/37.0 will be merged to git but no new release will be provided.
========================================================================== OSSA-2026-047: Redfish vendorpassthru method allows path injection via ID ==========================================================================
:Date: October 22, 2026 :CVE: CVE-2026-90458
Affects ~~~~~~~ Description ~~~~~~~~~~~ The Metal3.io Security team reported a vulnerability in Ironic's API. When calling the vendorpassthru API endpoint provided by the redfish management interface to create or delete a subscription, a malicious System-scoped Administrator could instead perform an HTTP DELETE or HTTP GET on an arbitrary path on a node's BMC. In a worst case scenario, this could lead to user accounts being deleted from the Redfish service on the BMC.
Only clouds with nodes enrolled in a redfish hardware type are susceptible to this vulnerability.
Patches ~~~~~~~ - https://review.opendev.org/1011870 (2024.1/caracal (unmaintained)) - https://review.opendev.org/1011868 (2025.1/epoxy) - https://review.opendev.org/1011866 (2025.2/flamingo) - https://review.opendev.org/1011864 (2026.1/gazpacho) - https://review.opendev.org/1011862 (2026.2/hibiscus) - https://review.opendev.org/1011860 (2027.1/indri (development)) - https://review.opendev.org/1011874 (Bugfix/37.0) - https://review.opendev.org/1011872 (Bugfix/38.0)
Credits ~~~~~~~ - Dmitry Tantsur, Metal3.io Security Team from Red Hat (CVE-2026-90458)
References ~~~~~~~~~~ - https://launchpad.net/bugs/2166507 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90458
Notes ~~~~~ - Patches for unmaintained/2024.1, bugfix/38.0 and bugfix/37.0 will be merged to git but no new release will be provided.
============================================================= ============================================================= Summary ~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io security team reported a vulnerability in Ironic. When a deployment can set instanceinfo/imagesource or Affected Services / Software ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Discussion ~~~~~~~~~~ The fix adds a [deploy]/imageserverauthhosts option allowing operators to restrict the hosts to which credentials are sent, along with a [deploy]/imageserverauthpermitunknownhosts option.
Deployments of OpenStack-integrated Ironic typically use Glance for image management and are not impacted by this vulnerability.
Recommended Actions ~~~~~~~~~~~~~~~~~~~ Operators utilizing the basic auth feature for image retrieval should:
Apply the relevant patch for their release set [deploy]/imageserverauthhosts to a list of acceptable hosts to pass authentication credentials to set [deploy]/imageserverauthpermitunknownhosts to False
Ironic intends to change the default of [deploy]/imageserverauthpermitunknownhosts to False in the 2027.1 release. See https://review.opendev.org/999907 for more information.
Patches 2026.2/hibiscus: https://review.opendev.org/999744 2026.1/gazpacho: https://review.opendev.org/1003587 2025.2/flamingo: https://review.opendev.org/1003597 2025.1/epoxy: https://review.opendev.org/1003598 bugfix/38.0: https://review.opendev.org/1003577 bugfix/37.0: https://review.opendev.org/1003579
Credits:
Tuomo Tanskanen, Metal3.io Security Team (Ericsson Software Technology) Dmitry Tantsur, Metal3.io Security Team (Red Hat)
Contacts / References ~~~~~~~~~~~~~~~~~~~~~ Author: Jay Faulkner (G-Research OSS)
Original bug : https://launchpad.net/bugs/2162816 This OSSN : https://docs.openstack.org/security-notes/OSSN-0110.html Mailing List : openstack-discuss () lists openstack org OpenStack Security : https://security.openstack.org/ CVE-2026-90461 : https://nvd.nist.gov/vuln/detail/CVE-2026-90461
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
============================================================ OSSA-2026-033: Portgroup shard filter bypasses project scope ============================================================
:Date: August 05, 2026 :CVE: CVE-2026-71201
Affects ~~~~~~~ - Ironic: >=34.0.0 <35.0.2, >=36.0.0 <38.0.1
Description ~~~~~~~~~~~ Chen YuXiang of Institute of Computing Technology, Chinese Academy of Sciences reported an issue in Ironic's API. When a project reader requests a list of portgroups filtered by shard, all portgroups in that shard are returned, not just those in their project.
This is a similar vulnerability to the one originally advisoried in OSSA-2026-026 -- that issue impacted ports; this impacts portgroups.
Patches ~~~~~~~ - https://review.opendev.org/999762 (2026.1/gazpacho) - https://review.opendev.org/999656 (2026.2/hibiscus (development)) - https://review.opendev.org/999765 (Bugfix/34.0) - https://review.opendev.org/999764 (Bugfix/37.0) - https://review.opendev.org/999763 (Bugfix/38.0)
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2162715 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71201
Notes ~~~~~ - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
Last updated 6 June 2026
Last updated 6 June 2026
Last updated 6 June 2026
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
HASH(0x5630150fd3c8)
================================================================================== ==================================================================================
:Date: July 08, 2026 :CVE: CVE-2026-44918
Affects ~~~~~~~ Description ~~~~~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team reported a vulnerability in Ironic's access control code.
This OSSA represents multiple related vulnerabilities in Ironic RBAC. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. This is tracked as bug #2150256.
Objects reparented in this manner cannot be detected via inspection of the data. Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, insuring the expected number of volume targets, and volume connectors are present.
Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node. This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on. This is tracked as bug #2150450.
Ironic now specifically checks, and requires node parents and children to have matching node.owner values. This patch contains an enhancement to Ironic's upgrade check to detect this mismatched state. Operators can use the provided ironic-status upgrade check to identify misconfigured nodes.
Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/996478 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/996476 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/996469 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/996462 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/ironic/+/996474 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/996471 (Bugfix/34.0) - https://review.opendev.org/c/openstack/ironic/+/996464 (Bugfix/37.0)
Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150256 - https://bugs.launchpad.net/ironic/+bug/2150450 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44918
Notes ~~~~~ - Volume Targets and Volume Connectors only contain sensitive information in environments utilizing boot-from-volume with iSCSI volumes. - These patches also contain hardening logic to prevent this class of vulnerability in Port and Portgroup objects. This is a defense in depth measure to provide consistent errors at the API level for invalid data. - Branch 2024.1/caracal is unmaintained and patches are provided as a courtesy. - Bugfix branches will recieve patches in git but will not recieve a updated release.
======================================================== OSSA-2026-025: RBAC Bypass in IPMI Raw Command Execution ========================================================
:Date: July 08, 2026 :CVE: CVE-2026-54423
Affects ~~~~~~~ Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/996477 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/992732 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/996475 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/992719 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/996466 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/992516 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/996473 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/992718 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/996470 (Bugfix/34.0) - https://review.opendev.org/c/openstack/ironic/+/992717 (Bugfix/34.0) - https://review.opendev.org/c/openstack/ironic/+/996463 (Bugfix/37.0) Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericcson Software Technology
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150458 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54423
Notes ~~~~~ - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.
In OpenStack Ironic 32 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instanceinfo['kstemplate'] is rendered without sandboxing.
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
======================================================================================== ========================================================================================
:Date: June 16, 2026 :CVE: CVE-2026-54421
Affects ~~~~~~~ Description ~~~~~~~~~~~ Tuomo Tanskanen (Ericsson Software Technology) and Dmitry Tantsur (Red Hat) of the Metal3.io Security Team discovered a vulnerability in Ironic API RBAC handling, where a user with a valid token and credentials to send a POST or PATCH request to /v1/volume/targets can have potentially sensitive properties returned in the response unredacted, such as iSCSI credentials.
Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/992326 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/992325 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/992321 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/992323 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/992322 (Bugfix/34.0)
Credits ~~~~~~~ - Tuomo Tanskanen from Ericsson Software Technology - Dmitry Tantsur from Red Hat
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2155049 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54421
Notes ~~~~~ - The vulnerable code path has existed since Ironic 9.0.0 (OpenStack Pike), however, this could only be considered an escalation of privileges after Ironic 17.0.0 (OpenStack Wallaby), when Ironic introduced the ability for project-scoped users to interact via the owner/lessee model. - Branches for 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmatian) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.
================================================================================ ================================================================================
:Date: June 03, 2026 :CVE: CVE-2026-46447
Affects ~~~~~~~ Description ~~~~~~~~~~~ Errata ~~~~~~ The initial patches issued to address the vulnerability would erroneously reject some valid kernel parameters, particularly when URL encoded. These bugs had no detrimental security impact, but may have caused unexpected failures. We apologize for the inconvienience. For a more rapid resolution of failures, operators can set CONF.conductor.disablekernelparameterparsing to false until they can apply the provided patches. applied for proper behavior.
Patches ~~~~~~~ Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150624 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46447
Notes ~~~~~ - Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmation) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches. - This fix removes the ability to put some valid -- but unlikely -- special characters into kernel command line overrides. There is an escape hatch for impacted clouds; setting CONF.conductor.disablekernelparameterparsing to true will restrict Ironic to only blocking the most dangerous, nonsensical special characters at the cost of being less security hardened against future attacks.
OSSA History ~~~~~~~~~~~~ - 2026-06-15 - Errata 1 - 2026-06-03 - Original Version
===================================================================== OSSA-2026-019: File Extraction from Ironic conductor via pxetemplate =====================================================================
:Date: June 03, 2026 :CVE: CVE-2026-44917
Affects ~~~~~~~ Description ~~~~~~~~~~~ Ironic intends on completely removing this feature in a future release.
Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/991382 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/991379 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/991376 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/991373 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/991370 (Bugfix/34.0)
Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2148319 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44917
Notes ~~~~~ - Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmation) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.
==================================================================================== ====================================================================================
:Date: June 03, 2026 :CVE: CVE-2026-48681
Affects ~~~~~~~ Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/991381 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/991378 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/991375 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/991372 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/991369 (Bugfix/34.0)
Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2148333 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48681
Notes ~~~~~ - Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmation) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.
================================================================================ ================================================================================
:Date: June 03, 2026 :CVE: CVE-2026-46447
Affects ~~~~~~~ Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/991380 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/991377 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/991374 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/991371 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/991368 (Bugfix/34.0)
Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology
References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150624 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46447
Notes ~~~~~ - Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmation) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches. - This fix removes the ability to put some valid -- but unlikely -- special characters into kernel command line overrides. There is an escape hatch for impacted clouds; setting CONF.conductor.disablekernelparameterparsing to true will restrict Ironic to only blocking the most dangerous, nonsensical special characters at the cost of being less security hardened against future attacks.