Improper access control in OpenStack Ironic - CVE-2026-44917
Published: June 18, 2026
Vulnerability identifier: #VU134857
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44917
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the pxe_template handling in Ironic boot interfaces when processing a user-supplied template path. A remote user can set node.driver_info[pxe_template] to a sensitive file path to disclose sensitive information.
The referenced file is placed into a TFTP or HTTP server for netbooting, where it can be fetched over the network from the conductor.
Affected software
OpenStack Ironic
Ubuntu
ironic (Ubuntu package)
Ubuntu
ironic (Ubuntu package)
How to mitigate CVE-2026-44917
Install security update from vendor's website.
OpenStack Ironic - addressed in versions 26.1.7, 29.0.6, 32.0.2, 35.0.2
ironic (Ubuntu package) - addressed in versions 1:20.1.0-0ubuntu1.3, 1:24.1.1-0ubuntu1.3, 1:32.0.0-0ubuntu1.1, 1:35.0.0-0ubuntu2.1
ironic (Ubuntu package) - addressed in versions 1:20.1.0-0ubuntu1.3, 1:24.1.1-0ubuntu1.3, 1:32.0.0-0ubuntu1.1, 1:35.0.0-0ubuntu2.1