EUVD-2026-25982Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege Ironic operator credentials
-
DeliveryIdentify deployment with console interface enabled
-
ExploitSend crafted Ironic API request to console driver
-
ExecutionTrigger ipmitool execution with attacker-controlled input
-
PersistExecute commands in ironic-conductor context
-
ImpactPivot to managed BMCs and bare-metal nodes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
| Exploitation Conditions | Exploitation requires: (1) Ironic deployed at version ≤25.0.0; (2) the non-default console interface explicitly enabled in the Ironic driver/console configuration (default deployments without a console interface are not affected); (3) network reachability to the Ironic API endpoint; and (4) valid credentials holding high Ironic operator privileges (CVSS PR:H), not ordinary tenant or guest accounts. No user interaction is required (UI:N). Limiting factors are significant: the non-default configuration requirement, the PR:H authentication bar, and the operator-only API surface together explain the very low EPSS (0.07%) and SSVC Automatable=no. |
| Impact | Signals are mixed but consistently point to a high-impact, low-likelihood issue. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High) driven by total CIA impact, but PR:H means the attacker must already hold privileged operator credentials, which sharply narrows realistic attackers. EPSS at 0.07% (20th percentile) and SSVC Exploitation=none, Automatable=no align with this: there is no evidence of in-the-wild use, and the prerequisite of a non-default console-interface configuration prevents opportunistic mass exploitation. Note an apparent tension: CVSS specifies AV:N, but the description ('ipmitool execution in a non-default configuration that has a console interface') implies the bug is reachable only via Ironic's API/console driver, so network exposure depends on whether the Ironic API is reachable from the attacker's network - verify against your deployment's API endpoint exposure. SSVC Technical Impact=total combined with C:H/I:H/A:H justifies prompt patching for operators who run the console interface, but this is not a CISA KEV / drop-everything issue. |
| Exploit ScenarioDerived | An attacker who has compromised or legitimately holds high-privilege Ironic operator credentials on an OpenStack cloud whose deployment has enabled the console interface sends an API request that drives the console driver, causing the ironic-conductor to invoke ipmitool with attacker-influenced parameters. This yields arbitrary IPMI/BMC interaction against managed bare-metal hosts and code execution in the conductor context, allowing tenant separation bypass, node tampering, or denial of service on physical hardware. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 18, 2026
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.
Earlier versions of this analysis (2)
Unsafe ipmitool invocation in OpenStack Ironic through 25.0.0 allows a privileged operator to execute ipmitool when a non-default console interface is configured, leading to high-impact compromise of the bare-metal provisioning service. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.07% (20th percentile), but SSVC marks technical impact as total. Vendor advisory OSSA-2026-008 documents the issue and oss-security disclosure 2026/04/30/1 corroborates it.
OpenStack Ironic through version 25.0.0 allows execution of arbitrary ipmitool commands when a non-default console interface is configured, enabling authenticated administrators to disclose sensitive information or modify system state. The vulnerability requires high privileges and deliberate configuration of a console interface, reducing real-world exposure but creating significant risk in environments where administrative trust boundaries are compromised.
RemediationAI
Patch available per vendor advisory: upgrade Ironic to the fixed release referenced in OSSA-2026-008 (https://security.openstack.org/ossa/OSSA-2026-008.html); no exact fixed version is independently confirmed in the supplied data, so consult the advisory for the patched stable-branch release matching your OpenStack series. As a compensating control until patched, disable or unconfigure the console interface on ironic-conductor (set the affected console driver out of [DEFAULT]/enabled_console_interfaces or the equivalent in your driver composition) - the trade-off is loss of remote serial-console access to managed bare-metal nodes for operators. Additionally, tighten Keystone RBAC so that only a minimal set of trusted operator roles hold the high-privilege Ironic API rights needed to reach the vulnerable code path, and restrict network access to the Ironic API (typically port 6385) to management networks only. Cross-reference the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/04/30/1 and Launchpad bug 2148331 for backport scope.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenStack Ironic is the bare-metal provisioning service in OpenStack, used to manage physical hardware lifecycle via IPMI, Redfish and serial console drivers. The vulnerability is classed as CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere), meaning Ironic invokes the external ipmitool binary in a code path reachable through the console interface when configured outside its default driver set. Because ipmitool runs with the privileges of the ironic-conductor process and can issue raw IPMI commands to managed BMCs, untrusted input flowing into its execution effectively bridges API-level operations into out-of-band hardware control. The affected component identified by CPE cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* covers all Ironic releases up to and including 25.0.0.
Know when Openstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
API-reachable so AV:N; requires non-default console interface configuration raising AC:H; needs high-privilege operator credentials so PR:H; ipmitool execution yields full CIA impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
OpenStack Ironic through 25.0.0 allows ipmitool execution in a non-default configuration that has a console interface.
Executive ViewAI
A command injection vulnerability (CVE-2026-42510, CVSS 7.2) in OpenStack Ironic's ipmitool integration could allow authenticated operators with high privileges to fully compromise bare-metal provisioning nodes' confidentiality, integrity, and availability; however, real-world exploitation likelihood is minimal (EPSS 0.1%) given the high privilege requirement and requirement for non-default console configuration. Organizations operating OpenStack bare-metal infrastructure should inventory affected deployments and implement compensating controls while monitoring for vendor patches.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable IPMI console interface if operationally unnecessary; (2) Restrict ipmitool execution permissions to minimum-privilege operators via role-based access control; (3) Implement comprehensive audit logging of all ipmitool command execution; (4) Apply network segmentation to bare-metal provisioning management interfaces; (5) Subscribe to OpenStack security announcements for patched release notification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
GitHub PoC
Exploit-DB