Skip to content
Openstack Ironic vulnerabilities
-
openstack ironic
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete...
CVE-2026-90458
Fix available
5.4 Medium
-
openstack ironic
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a...
CVE-2026-89419
Fix available
5.0 Medium
-
openstack ironic
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a...
CVE-2026-115638
Fix available
4.3 Medium
-
openstack ironic
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host...
CVE-2026-90461
Fix available
6.3 Medium
-
openstack ironic
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning...
CVE-2026-74250
Fix available
6.3 Medium
-
openstack ironic
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can...
CVE-2026-71201
Fix available
5.0 Medium
-
openstack ironic python agent
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can...
CVE-2026-66138
Fix available
7.2 High
-
openstack ironic python agent
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using...
CVE-2026-54422
Fix available
5.5 Medium
-
openstack ironic
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI...
CVE-2026-54423
Fix available
8.2 High
-
openstack ironic
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project...
CVE-2026-44918
Fix available
5.5 Medium
-
openstack ironic
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
CVE-2026-54421
Fix available
6.8 Medium
-
openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 more
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
CVE-2026-50589
Fix available
5.3 Medium
-
openstack ironic
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
CVE-2026-48681
Fix available
5.9 Medium
-
openstack ironic
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read...
CVE-2026-44917
Fix available
4.9 Medium
-
openstack ironic
OpenStack Ironic allows Boot Script Injection
CVE-2026-46447
Fix available
5.8 Medium
-
openstack ironic
OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
CVE-2026-44919
Fix available
4.3 Medium
-
openstack ironic
In OpenStack Ironic through 35.x, instance_info['ks_template'] is rendered without sandboxing.
CVE-2026-44916
Fix available
3.0 Low
-
openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 more
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
CVE-2026-42997
Fix available
7.7 High
-
openstack ironic-python-agent, ironic python agent, red hat openshift container platform 4 +4 more +6 more
OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
CVE-2026-43003
Fix available
8.0 High
-
openstack ironic
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
CVE-2026-42510
Fix available
6.6 Medium
-
openstack ironic
OpenStack Ironic fails to restrict paths used for file:// image URLs
CVE-2025-44021
Fix available
2.8 Low
-
openstack ironic-inspector, redhat openstack, openstack-ironic-inspector +2 more
Openstack ironic-inspector has SQL injection vulnerability in node_cache
CVE-2019-10141
Fix available
8.3 High
-
openstack ironic
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote...
CVE-2015-7514
Fix available
6.5 Medium
-
openstack ironic inspector
Injection vulnerability that affects ironic-discoverd
CVE-2015-5306
Fix available
6.8 Medium