Description
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ironic | 1:5.1.2-1 | — |
| Debian 13 | ironic | 1:5.1.2-1 | — |
| Debian 12 | ironic | 1:5.1.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ironic | 1:5.1.2-0ubuntu1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 8 | openstack-ironic +3 | 1:4.2.5-1.el7ost | RHSA-2016:1378 |
| Red Hat OpenStack 7 | openstack-ironic +3 | 2015.1.2-4.el7ost | RHSA-2016:1377 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 6 | openstack-designate | 1.0.3~a0~dev10-6.1 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-designate-doc | 1.0.3~a0~dev10-6.2 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-ironic | 4.2.5-6.1 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-ironic-doc | 4.2.5-6.2 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-vpnaas +1 | 7.0.5~a0~dev3-6.1 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-nova-docker | 0.0.1~a0~dev238-4.1 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-sahara +1 | 3.0.3~a0~dev1-6.1 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-tempest | 7.0.0-9.1 | SUSE-SU-2016:1966-1 |
| SUSE OpenStack Cloud 6 | openstack-trove +1 | 4.0.1~a0~dev19-8.1 | SUSE-SU-2016:1966-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ironic | < 4.2.5 | 4.2.5 | GHSA-f7cr-7c2c-fm8r |
| PyPI | ironic | >= 5.0, < 5.1.2 | 5.1.2 | GHSA-f7cr-7c2c-fm8r |
| PyPI | ironic | < 4.2.5 · >= 5.0, < 5.1.2 | 4.2.5, 5.1.2 | PYSEC-2026-646 |
Advisories 3
- RHSA-2016:1378 Red Hat Security Advisory: openstack-ironic security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:1377 Red Hat Security Advisory: openstack-ironic security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- SUSE-SU-2016:1966-1 Security update for several openstack-components SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://review.openstack.org/332197
- https://bugs.launchpad.net/ironic/+bug/1572796
- [oss-security] 20160621 Ironic node information including credentials exposed to unathenticated users mailing-list
- https://review.openstack.org/332195
- RHSA-2016:1378 vendor-advisory
- RHSA-2016:1377 vendor-advisory
- https://review.openstack.org/332196