openstack/ironic · Security
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
- GHSA ID
- GHSA-wqpv-c3pp-3m58
- CVE ID
- CVE-2026-42510
- Severity
- medium
- Published
- Updated
- CVSS
- 6.6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 6.6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
CWEs
- CWE-829 · Inclusion of Functionality from Untrusted Control Sphere