CVE-2015-5306

Injection vulnerability that affects ironic-discoverd

6.8 MediumFix available

OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.

Exploit likelihood

1.60%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2015-5306
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-254
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-5306
Updated: 2026-11-02

EUVDEUVD-2015-0025 No score

Record: EUVD-2015-0025
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x64g-wjmw-w328 9.2

Injection vulnerability that affects ironic-discoverd

Record: GHSA-x64g-wjmw-w328
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-x64g-wjmw-w328 9.2

Injection vulnerability that affects ironic-discoverd

Record: GHSA-x64g-wjmw-w328
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2026-505 9.2

Injection vulnerability that affects ironic-discoverd

Record: PYSEC-2026-505
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

Record: CVE-2015-5306
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-5306 No score

Record: DEBIAN-CVE-2015-5306
Updated: 2026-11-02

OSVPYSEC-2015-28 No score

Record: PYSEC-2015-28
Updated: 2026-11-02

Affected products

openstack ironic inspector

Affected packages

Affected packages
Package	Affected	Fixed
`python-ironic-inspector-client` PyPI	before 0.2.5	0.2.5
`ironic-inspector` PyPI	before 2.2.2	2.2.2
`ironic-inspector` Debian:12	before 3.2.0-1	3.2.0-1
`ironic-inspector` Debian:13	before 3.2.0-1	3.2.0-1
`ironic-inspector` PyPI	before 2.2.2, plus listed versions 2.0.02.0.12.1.02.2.02.2.1	2.2.2
`ironic-inspector` PyPI	before 2.3.0, plus listed versions 2.0.02.0.12.1.02.2.02.2.1 Show 6 moreShow less 2.2.22.2.32.2.42.2.52.2.62.2.7	2.3.0
`openstack-ironic-discoverd` Red Hat:openstack-director:7::el7	before 0:1.1.0-8.el7ost	0:1.1.0-8.el7ost
`openstack-ironic-discoverd-ramdisk` Red Hat:openstack-director:7::el7	before 0:1.1.0-8.el7ost	0:1.1.0-8.el7ost
`python-ironic-discoverd` Red Hat:openstack-director:7::el7	before 0:1.1.0-8.el7ost	0:1.1.0-8.el7ost
`openstack-ironic-discoverd` Red Hat:openstack:6::el7	before 0:0.2.5-2.el7ost	0:0.2.5-2.el7ost

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5306 is a medium vulnerability (CVSS 6.8) in Openstack Ironic Inspector, published November 25, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in python-ironic-inspector-client 0.2.5.

References

Show 13 moreShow less