Read the docs
TI-2023-21383 Aliases CVE-2023-40585

Unauthenticated access to Ironic API

Priority LOW 39CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
metal3-ioironic-image< capm3-v1.4.3—No fix listedCNA
  • ironic-image Vendormetal3-io Affected < capm3-v1.4.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:metal3:ironic-image:*:*:*:*:*:*:*:*before 1.4.3VulnerableMetal3
  • cpe:2.3:a:metal3:ironic-image:*:*:*:*:*:*:*:* Versions before 1.4.3 Vulnerable ·Metal3

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40585

References

Patch 2

  • TI-2025-21192 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD CVSS 3.1MEDIUM 6.5
  • TI-2024-29397 BMO can expose particularly named secrets from other namespaces via BMH CRD CVSS 3.1MEDIUM 4.9
  • TI-2024-20827 Ironic-image allows unauthenticated local access to Ironic API CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences