CVE-2026-44917

Summary

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

Affected Software

VendorProductVersion RangeStatus
OpenStackIronic17.0.0 < 26.1.7affected
OpenStackIronic27.0.0 < 29.0.6affected
OpenStackIronic30.0.0 < 32.0.2affected
OpenStackIronic33.0.0 < 35.0.2affected

Weaknesses

  • CWE-669: CWE-669 Incorrect Resource Transfer Between Spheres

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References