EUVD-2026-27428
GHSA-54w4-233h-x86g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
AnalysisAI
Credential forwarding vulnerability in OpenStack Ironic's idrac driver allows authenticated attackers to steal time-limited Keystone tokens or molds storage credentials by manipulating import operations. Attackers with low-privileged Ironic access can redirect these credentials to attacker-controlled endpoints, gaining unauthorized access to all OpenStack services that Ironic is authorized for. Fixed in versions 26.1.6, 29.0.5, 32.0.1, and 35.0.1. CVSS 7.7 with scope change (S:C) reflects the privilege escalation from Ironic-only access to full OpenStack service access.
Technical ContextAI
OpenStack Ironic is a bare-metal provisioning service that manages physical hardware through driver interfaces. The idrac driver interfaces with Dell iDRAC (Integrated Dell Remote Access Controller) for server management. The vulnerability (CWE-669: Incorrect Resource Transfer Between Spheres) exists in the molds import functionality, where the driver forwards authentication credentials to remote endpoints during hardware configuration operations. Keystone is OpenStack's identity service that issues time-limited authentication tokens providing federated access across OpenStack components (Nova, Neutron, Cinder, etc.). The affected CPE confirms this is specific to the openstack:ironic product, with the Dell and Ironic tags indicating the issue is within the Dell hardware driver implementation.
RemediationAI
Upgrade OpenStack Ironic to fixed versions: 26.1.6 (Zed branch), 29.0.5 (2023.1/Antelope), 32.0.1 (2023.2/Bobcat), or 35.0.1 (2024.1/Caracal or later). Apply the appropriate patch for your OpenStack release branch following the oss-security advisory at https://www.openwall.com/lists/oss-security/2026/05/05/10. If immediate patching is not feasible, disable the molds import functionality in idrac driver configurations as a compensating control, though this will prevent automated hardware configuration workflows and require manual provisioning processes. Alternatively, implement network-level egress filtering to restrict Ironic nodes from initiating outbound connections to untrusted endpoints, which prevents credential exfiltration but may impact legitimate driver operations requiring external connectivity. Audit Keystone token scopes assigned to Ironic service accounts and apply principle of least privilege to limit blast radius of stolen tokens. Review Ironic API access logs for suspicious molds import requests targeting external endpoints.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today