Summary
Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not
properly validate file paths when handling ISO images. A privileged
authenticated remote user could use this issue to perform path
traversal via a crafted ISO image and overwrite arbitrary files on
the Ironic conductor. (CVE-2026-48681)
Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not
properly validate kernel command line parameters. A privileged
authenticated remote user could use this issue to inject
scripts during node boot and possibly execute arbitrary code.
(CVE-2026-46447)
Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic
incorrectly restricted access to custom PXE templates. A privileged
authenticated remote user could use this issue to read arbitrary
sensitive files on the Ironic conductor. (CVE-2026-44917)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | ironic | 1:20.1.0-0ubuntu1.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | ironic | 1:24.1.1-0ubuntu1.3 |
| Ubuntu · 25.10 | ironic | 1:32.0.0-0ubuntu1.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | ironic | 1:35.0.0-0ubuntu2.1 |
Vulnerabilities 3
-
Medium 5.9
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
-
Medium 5.8
OpenStack Ironic allows Boot Script Injection
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
-
Medium 4.9
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Iro…