CVE-2026-44917
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
Risk Assessment
An authenticated attacker can read sensitive local files on the conductor server, potentially leading to data leakage or privilege escalation.
Recommendation
Update OpenStack Ironic to version 35.0.2 or later.
Other vulnerabilities in OpenStack Ironic
See all- CVE-2016-4985High
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
- CVE-2026-90458Medium
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, for example to delete accounts from the BMC's Redfish service.
- CVE-2026-89419Medium
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident}, i.e., not using the specific maintenance endpoint.
- CVE-2026-115638Medium
OpenStack Ironic through version 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, also known as a gzip bomb.
- CVE-2026-90461Medium
OpenStack Ironic through version 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. Credentials may leak to an unintended recipient.
- CVE-2026-74250Medium
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
- CVE-2026-71201Medium
In OpenStack Ironic through 38.0.0, a project reader making a crafted request can return Portgroups assigned to Nodes owned or leased by another project.
- CVE-2026-54423High
In OpenStack Ironic before version 37.0.1, a user with the ability to deploy nodes via the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
- CVE-2026-44918Medium
A vulnerability in OpenStack Ironic before version 37.0.1 allows unauthorized creation or modification of nodes across projects. Lack of proper authorization enables an attacker to manipulate resources without required permissions.
- CVE-2026-54421Medium
In OpenStack Ironic before version 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials).
Original NVD description (English source)
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS