Priority HIGH 72
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00433 · Published 2026-06-04 · Fixed in 37.0.0 CWE-770
Priority LOW 38
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00601 · Published 2026-06-04 · Partial fix · 26.1.7, 29.0.6 +2 CWE-23
Priority LOW 22
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00283 · Published 2026-06-04 · Partial fix · 26.1.7, 29.0.6 +2 CWE-669
Priority LOW 33
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00262 · Published 2026-06-03 · Partial fix · 26.1.7, 29.0.6 +2 CWE-669
Priority MEDIUM 62
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00466 · Published 2026-05-14 · Fixed in 29.0.6, 32.0.2 +1 CWE-696
Priority LOW 15
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
CVSS 3.1LOW 3.0· Network · High privileges · No interaction · EPSS 0.00336 · Published 2026-05-08 · Fixed in 26.1.7, 29.0.6 +2 CWE-1336
Priority LOW 34
An issue was discovered in idrac in OpenStack Ironic before 35.0.1.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00433 · Published 2026-05-05 · Partial fix · 26.1.6, 29.0.5 +2 CWE-669
Priority LOW 34
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00567 · Published 2026-04-28 · Partial fix · 26.1.6, 29.0.5 +2 CWE-829
Priority LOW 32
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01577 · Published 2017-06-07 · No fix listed CWE-200
THREATIST.IORead the docs