CVE-2026-42997
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
CVE-2026-42997- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-669, CWE-201
- Updated
- 2026-11-02
EUVDEUVD-2026-27428
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
EUVD-2026-27428- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-54w4-233h-x86g
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
GHSA-54w4-233h-x86g- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
NVD
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
CVE-2026-42997- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-669, CWE-201
- Updated
- 2026-11-02
OSV
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
CVE-2026-42997- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42997
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
DEBIAN-CVE-2026-42997- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-54w4-233h-x86g
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
GHSA-54w4-233h-x86g- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVPYSEC-2026-2526
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
PYSEC-2026-2526- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:39811
Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) security update
- Record
RHSA-2026:39811- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-42997
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Record
UBUNTU-CVE-2026-42997- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ironic-python-agentPyPI |
33.0.0 up to 35.0.1 | 35.0.1 |
ironic-python-agentPyPI |
30.0.0 up to 32.0.1 | 32.0.1 |
ironic-python-agentPyPI |
27.0.0 up to 29.0.5 | 29.0.5 |
ironic-python-agentPyPI |
before 26.1.6 | 26.1.6 |
ironicDebian:12 |
before 1:21.1.0-3+deb12u1, plus listed versions 1:21.1.0-3 |
1:21.1.0-3+deb12u1 |
ironicDebian:13 |
before 1:29.0.5-0+deb13u1, plus listed versions 1:29.0.0-7 |
1:29.0.5-0+deb13u1 |
ironicDebian:14 |
before 1:35.0.1-1, plus listed versions 1:29.0.0-71:32.0.0-11:32.0.0-21:32.0.0-41:32.0.0-5 Show 5 moreShow less1:32.0.0-61:32.0.0-71:34.0.0-11:35.0.0-11:35.0.0-2 |
1:35.0.1-1 |
ironic-python-agentPyPI |
before 26.1.6, plus listed versions 0.0.11.0.01.0.11.0.21.0.3 Show 45 moreShow less1.0.41.0.51.1.01.2.01.2.11.2.21.2.31.3.01.4.01.5.01.5.11.5.210.0.010.1.010.2.010.2.110.2.210.2.311.0.011.1.011.2.011.3.011.4.011.5.011.6.012.0.02.0.02.0.12.0.22.0.32.1.02.2.02.2.12.2.22.2.32.2.43.0.03.1.03.2.03.2.13.2.23.2.33.2.43.3.03.3.1 |
26.1.6 |
ironic-python-agentPyPI |
before 26.1.6, 27.0.0 up to 29.0.5, 30.0.0 up to 32.0.1, 33.0.0 up to 35.0.1, plus listed versions 0.0.11.0.01.0.11.0.21.0.3 Show 45 moreShow less1.0.41.0.51.1.01.2.01.2.11.2.21.2.31.3.01.4.01.5.01.5.11.5.210.0.010.1.010.2.010.2.110.2.210.2.311.0.011.1.011.2.011.3.011.4.011.5.011.6.012.0.02.0.02.0.12.0.22.0.32.1.02.2.02.2.12.2.22.2.32.2.43.0.03.1.03.2.03.2.13.2.23.2.33.2.43.3.03.3.1 |
26.1.629.0.532.0.135.0.1 |
openstack-ironicRed Hat:openstack:18.0::el9 |
before 1:21.4.5-18.0.20260616204937.9213ccd.el9ost | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-ironic-apiRed Hat:openstack:18.0::el9 |
before 1:21.4.5-18.0.20260616204937.9213ccd.el9ost | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
openstack-ironic-commonRed Hat:openstack:18.0::el9 |
before 1:21.4.5-18.0.20260616204937.9213ccd.el9ost | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
openstack-ironic-conductorRed Hat:openstack:18.0::el9 |
before 1:21.4.5-18.0.20260616204937.9213ccd.el9ost | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
ironicUbuntu:16.04:LTS |
All versions, plus listed versions 1:4.2.0-0ubuntu11:4.3.0-0ubuntu11:5.1.0-0ubuntu11:5.1.2-0ubuntu1 |
None known |
ironicUbuntu:18.04:LTS |
All versions, plus listed versions 1:9.1.0-0ubuntu21:9.2.0-0ubuntu11:10.0.0-0ubuntu11:10.1.0-0ubuntu11:10.1.1-0ubuntu11:10.1.1-0ubuntu2 |
None known |
ironicUbuntu:20.04:LTS |
All versions, plus listed versions 1:13.0.1-0ubuntu11:14.0.0~b1~git2019121713.76597ca93-0ubuntu11:14.0.0~b1~git2019121713.76597ca93-0ubuntu21:14.0.0-0ubuntu11:14.0.1~git2020032415.de2d907fc-0ubuntu11:14.0.1~git2020041013.af9e6ba90-0ubuntu21:15.0.0-0ubuntu0.20.04.1 |
None known |
ironicUbuntu:22.04:LTS |
All versions, plus listed versions 1:18.2.0-0ubuntu11:18.2.0+git2021120910.cdc3b9538-0ubuntu11:19.0.0+git2022011216.7beadee46-0ubuntu11:20.0.0+git2022030313.4e6a3d52e-0ubuntu11:20.1.0-0ubuntu11:20.1.0-0ubuntu1.11:20.1.0-0ubuntu1.21:20.1.0-0ubuntu1.3 |
None known |
ironicUbuntu:24.04:LTS |
All versions, plus listed versions 1:23.0.0-0ubuntu31:23.1.0+git2024011916.a374a0c1-0ubuntu11:24.1.0-0ubuntu11:24.1.1-0ubuntu11:24.1.1-0ubuntu1.21:24.1.1-0ubuntu1.3 |
None known |
ironicUbuntu:25.10 |
All versions, plus listed versions 1:29.0.0-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu21:32.0.0-0ubuntu11:32.0.0-0ubuntu1.1 |
None known |
ironicUbuntu:26.10 |
All versions, plus listed versions 1:35.0.0-0ubuntu21:35.0.0-0ubuntu31:38.0.0+git20260818.101.f8e78b0-0ubuntu11:38.0.0+git2026091517.26c022f13-0ubuntu11:39.0.0-0ubuntu1 |
None known |
ironicUbuntu:26.04:LTS |
All versions, plus listed versions 1:32.0.0-0ubuntu11:34.0.0-0ubuntu11:35.0.0-0ubuntu11:35.0.0-0ubuntu21:35.0.0-0ubuntu2.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42997 is a high vulnerability (CVSS 7.7) in Openstack Ironic, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in ironic-python-agent 35.0.1.
References
openwall.com/lists/oss-security/2026/05/05/10
security.openstack.org/ossa/OSSA-2026-010.html
access.redhat.com/security/cve/CVE-2026-42997
bugzilla.redhat.com/show_bug.cgi?id=2466844
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42997.json
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-42997
github.com/advisories/GHSA-54w4-233h-x86g
security-tracker.debian.org/tracker/CVE-2026-42997
pypi.org/project/ironic-python-agent
cve.org/CVERecord?id=CVE-2026-42997
ubuntu.com/security/CVE-2026-42997
bugs.launchpad.net/ironic/+bug/2148317
Left out here: 148 versions. The JSON record has them.