CVE-2026-44916

Summary

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

Affected Software

VendorProductVersion RangeStatus
OpenStackIronic17.0.0 < 26.1.7affected
OpenStackIronic27.0.0 < 29.0.6affected
OpenStackIronic30.0.0 < 32.0.2affected
OpenStackIronic33.0.0 < 35.0.2affected

Weaknesses

  • CWE-1336: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References