EUVD-2026-28531
GHSA-979m-gf7m-rg53
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In OpenStack Ironic through 35.x, instance_info['ks_template'] is rendered without sandboxing.
AnalysisAI
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose sensitive information by rendering unsandboxed Jinja2 templates in the instance_info['ks_template'] parameter. The vulnerability requires high-privilege user interaction and has low confidentiality impact with no integrity or availability consequences.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated network access to OpenStack Ironic with high-privilege administrator or operator credentials that permit instance creation and modification of instance_info metadata. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the CVSS 3.0 score, real-world risk is constrained by multiple exploitation factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An OpenStack operator with administrative privileges to Ironic deliberately or accidentally creates a bare-metal instance with a malicious ks_template value containing Jinja2 expressions like '{{ config }}' or '{{ context.keys() }}'. When Ironic renders the template during provisioning, the expressions are evaluated and expose internal template context variables, allowing the operator to extract deployment metadata, configuration values, or other sensitive context information embedded in the rendering environment. |
| Remediation | Apply the security patch available via OpenStack Ironic upstream releases following version 35.x; consult the LaunchPad bug tracker (https://bugs.launchpad.net/ironic/+bug/2148307) for exact patched version availability and timeline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh inst
Server-side template injection in Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.2.x allows remote attackers to
Share
External POC / Exploit Code
Leaving vuln.today