Every CVE Search/ Get API key

CVE-2026-46447

OpenStack Ironic allows Boot Script Injection

5.8 MediumFix available

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.26%Up 0.2 points since Jun 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.8

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Record
CVE-2026-46447
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-669
Updated
2026-11-02
EUVDEUVD-2026-34181 5.8

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Record
EUVD-2026-34181
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jrh2-f5jc-xpgr 5.8

OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection.

Record
GHSA-jrh2-f5jc-xpgr
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-669
Updated
2026-11-02
NVD 5.8

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Record
CVE-2026-46447
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-669
Updated
2026-11-02
OSV 5.8

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Record
CVE-2026-46447
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-669
Updated
2026-11-02
OSVDEBIAN-CVE-2026-46447 7.7

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Record
DEBIAN-CVE-2026-46447
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-jrh2-f5jc-xpgr 5.8

OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection.

Record
GHSA-jrh2-f5jc-xpgr
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-669
Updated
2026-11-02
OSVPYSEC-2026-3471 5.8

OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection.

Record
PYSEC-2026-3471
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-46447 5.8

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Record
UBUNTU-CVE-2026-46447
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUSN-8421-1 No score

ironic vulnerabilities

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor. (CVE-2026-48681)

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate kernel command line parameters. A privileged authenticated remote user could use this issue to inject scripts during node boot and possibly execute arbitrary code. (CVE-2026-46447)

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic incorrectly restricted access to custom PXE templates. A privileged authenticated remote user could use this issue to read arbitrary sensitive files on the Ironic conductor. (CVE-2026-44917)

Record
USN-8421-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ironic
PyPI
 17.0.0 up to 26.1.7
26.1.7
ironic
PyPI
 27.0.0 up to 29.0.6
29.0.6
ironic
PyPI
 30.0.0 up to 32.0.2
32.0.2
ironic
PyPI
 33.0.0 up to 35.0.2
35.0.2
ironic
Debian:12
 before 1:21.4.4-0+deb12u1, plus listed versions
1:21.1.0-31:21.1.0-3+deb12u11:21.3.0-11:21.4.0-11:21.4.0-21:21.4.0-31:21.4.0-4
1:21.4.4-0+deb12u1
ironic
Debian:13
 before 1:29.0.5-0+deb13u2, plus listed versions
1:29.0.0-71:29.0.5-0+deb13u1
1:29.0.5-0+deb13u2
ironic
Debian:14
 before 1:35.0.1-5, plus listed versions
1:29.0.0-71:32.0.0-11:32.0.0-21:32.0.0-41:32.0.0-5
Show 8 moreShow less
1:32.0.0-61:32.0.0-71:34.0.0-11:35.0.0-11:35.0.0-21:35.0.1-11:35.0.1-21:35.0.1-3
1:35.0.1-5
ironic
PyPI
 17.0.0 up to 26.1.7, plus listed versions
17.0.117.0.217.0.317.0.417.1.0
Show 45 moreShow less
18.0.018.1.018.2.018.2.118.2.218.3.019.0.020.0.020.1.020.1.120.1.220.1.320.2.021.0.021.1.021.1.121.1.221.2.021.3.021.4.021.4.121.4.221.4.321.4.422.0.022.1.023.0.023.0.123.0.223.0.323.0.423.0.523.1.024.0.024.1.024.1.124.1.224.1.324.1.424.1.525.0.026.0.026.1.026.1.126.1.2
26.1.7
ironic
PyPI
 27.0.0 up to 29.0.6, plus listed versions
28.0.029.0.029.0.129.0.229.0.329.0.429.0.5
29.0.6
ironic
PyPI
 30.0.0 up to 32.0.2, plus listed versions
31.0.032.0.032.0.1
32.0.2
Show 7 moreShow less
Affected packages
PackageAffectedFixed
ironic
PyPI
 33.0.0 up to 35.0.2, plus listed versions
34.0.035.0.035.0.1
35.0.2
ironic
PyPI
 17.0.0 up to 26.1.7, 27.0.0 up to 29.0.6, 30.0.0 up to 32.0.2, 33.0.0 up to 35.0.2, plus listed versions
17.0.117.0.217.0.317.0.417.1.0
Show 45 moreShow less
18.0.018.1.018.2.018.2.118.2.218.3.019.0.020.0.020.1.020.1.120.1.220.1.320.2.021.0.021.1.021.1.121.1.221.2.021.3.021.4.021.4.121.4.221.4.321.4.422.0.022.1.023.0.023.0.123.0.223.0.323.0.423.0.523.1.024.0.024.1.024.1.124.1.224.1.324.1.424.1.525.0.026.0.026.1.026.1.126.1.2
26.1.729.0.632.0.235.0.2
ironic
Ubuntu:22.04:LTS
 before 1:20.1.0-0ubuntu1.3, plus listed versions
1:18.2.0-0ubuntu11:18.2.0+git2021120910.cdc3b9538-0ubuntu11:19.0.0+git2022011216.7beadee46-0ubuntu11:20.0.0+git2022030313.4e6a3d52e-0ubuntu11:20.1.0-0ubuntu11:20.1.0-0ubuntu1.11:20.1.0-0ubuntu1.2
1:20.1.0-0ubuntu1.3
ironic
Ubuntu:24.04:LTS
 before 1:24.1.1-0ubuntu1.3, plus listed versions
1:23.0.0-0ubuntu31:23.1.0+git2024011916.a374a0c1-0ubuntu11:24.1.0-0ubuntu11:24.1.1-0ubuntu11:24.1.1-0ubuntu1.2
1:24.1.1-0ubuntu1.3
ironic
Ubuntu:25.10
 before 1:32.0.0-0ubuntu1.1, plus listed versions
1:29.0.0-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu21:32.0.0-0ubuntu1
1:32.0.0-0ubuntu1.1
ironic
Ubuntu:26.10
 All versions, plus listed versions
1:35.0.0-0ubuntu21:35.0.0-0ubuntu31:38.0.0+git20260818.101.f8e78b0-0ubuntu11:38.0.0+git2026091517.26c022f13-0ubuntu11:39.0.0-0ubuntu1
 None known
ironic
Ubuntu:26.04:LTS
 before 1:35.0.0-0ubuntu2.1, plus listed versions
1:32.0.0-0ubuntu11:34.0.0-0ubuntu11:35.0.0-0ubuntu11:35.0.0-0ubuntu2
1:35.0.0-0ubuntu2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-46447 is a medium vulnerability (CVSS 5.8) in Openstack Ironic, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in ironic 26.1.7.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 21 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open