What is the CVSS score of EUVD-2026-25982?

EUVD-2026-25982 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenStack Ironic are affected by EUVD-2026-25982?

A command injection vulnerability (CVE-2026-42510, CVSS 7.2) in OpenStack Ironic's ipmitool integration could allow authenticated operators with high privileges to fully compromise bare-metal…. A patch is available.

How to fix or mitigate EUVD-2026-25982?

Within 24 hours: Identify all OpenStack Ironic deployments at version 25.0.0 or earlier with console interfaces enabled and validate operator privilege separation controls. Within 7 days: Assess operational necessity of IPMI console functionality; if non-critical, disable ipmitool integration or restrict execution permissions to minimally-privileged operators only. Within 30 days: Monitor OpenStack security advisories for patched releases; prepare testing and deployment procedures in advance of vendor patch availability.

OpenStack Ironic EUVD-2026-25982

| CVE-2026-42510 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-04-28 mitre

Information Disclosure Ironic

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

API-reachable so AV:N; requires non-default console interface configuration raising AC:H; needs high-privilege operator credentials so PR:H; ipmitool execution yields full CIA impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

6.6 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 03:52 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 03:51 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 03:38 vuln.today

cvss_changed

Severity Changed

Jun 18, 2026 - 03:38 NVD

MEDIUM HIGH

CVSS changed

Jun 18, 2026 - 03:38 NVD

6.6 (MEDIUM) 7.2 (HIGH)

Analysis Generated

Apr 28, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 05:30 euvd

EUVD-2026-25982

Analysis Generated

Apr 28, 2026 - 05:30 vuln.today

CVE Published

Apr 28, 2026 - 04:53 nvd

MEDIUM 6.6

DescriptionNVD

OpenStack Ironic through 25.0.0 allows ipmitool execution in a non-default configuration that has a console interface.

AnalysisAI

Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.

Technical ContextAI

OpenStack Ironic is the bare-metal provisioning service in OpenStack, used to manage physical hardware lifecycle via IPMI, Redfish and serial console drivers. The vulnerability is classed as CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere), meaning Ironic invokes the external ipmitool binary in a code path reachable through the console interface when configured outside its default driver set. Because ipmitool runs with the privileges of the ironic-conductor process and can issue raw IPMI commands to managed BMCs, untrusted input flowing into its execution effectively bridges API-level operations into out-of-band hardware control. The affected component identified by CPE cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* covers all Ironic releases up to and including 25.0.0.

RemediationAI

Patch available per vendor advisory: upgrade Ironic to the fixed release referenced in OSSA-2026-008 (https://security.openstack.org/ossa/OSSA-2026-008.html); no exact fixed version is independently confirmed in the supplied data, so consult the advisory for the patched stable-branch release matching your OpenStack series. As a compensating control until patched, disable or unconfigure the console interface on ironic-conductor (set the affected console driver out of [DEFAULT]/enabled_console_interfaces or the equivalent in your driver composition) - the trade-off is loss of remote serial-console access to managed bare-metal nodes for operators. Additionally, tighten Keystone RBAC so that only a minimal set of trusted operator roles hold the high-privilege Ironic API rights needed to reach the vulnerable code path, and restrict network access to the Ironic API (typically port 6385) to management networks only. Cross-reference the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/04/30/1 and Launchpad bug 2148331 for backport scope.