What is the CVSS score of EUVD-2026-34202?

EUVD-2026-34202 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34202?

Yes, a patch is available for EUVD-2026-34202. Update the affected software to the latest version immediately.

OpenStack Ironic EUVD-2026-34202

| CVE-2026-44917 MEDIUM

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-06-03

GHSA-3g4p-c74p-mh7x

Information Disclosure Ironic

4.9

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 04, 2026 - 05:00 EUVD

CVSS changed

Jun 04, 2026 - 04:22 NVD

4.9 (MEDIUM)

Analysis Generated

Jun 03, 2026 - 18:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

File extraction from the Ironic conductor service is possible via a crafted pxe_template, as disclosed in OpenStack Security Advisory OSSA-2026-019. The Ironic conductor is a privileged management component that coordinates bare metal node provisioning; arbitrary file read from this host could expose infrastructure credentials, TLS keys, or cloud configuration secrets. No public exploit has been identified at time of analysis, and no CVSS score has been assigned, but the severity is elevated by the conductor's privileged position in OpenStack infrastructure.

Technical ContextAI

OpenStack Ironic is the bare metal provisioning service within the OpenStack ecosystem; its conductor daemon executes privileged operations against physical hardware, including PXE boot orchestration. PXE templates in Ironic define the network boot configuration rendered by the conductor and served to bare metal nodes during provisioning. The vulnerability resides in the pxe_template processing pipeline, where insufficient sanitization of user-supplied template content or path references allows an attacker to cause the conductor to read and return arbitrary files from its own filesystem - a classic server-side file read or path traversal class of issue. No CWE has been formally assigned, but the behavior is consistent with CWE-22 (Path Traversal) or CWE-94 (Improper Control of Code Generation / Template Injection). The conductor typically runs with elevated OS privileges and stores sensitive material such as IPMI credentials, iDRAC configs, and cloud operator certificates.

RemediationAI

The primary fix is to apply the upstream Gerrit patches: review.opendev.org/c/openstack/ironic/+/991373 for the bugfix/33.0 line and review.opendev.org/c/openstack/ironic/+/991370 for the bugfix/34.0 line. Note that the OpenStack Ironic team has stated no additional tagged release will be made from these bugfix branches - operators must cherry-pick or apply the patch manually from git. Releases 2023.2 (bobcat) and 2024.2 (dalmation) will not receive patches and operators on those versions should upgrade to a maintained release immediately. As a compensating control where patching is not immediately possible, restrict Ironic API access to only trusted operator credentials and audit which users have permission to create or modify nodes with custom pxe_template fields. Additionally, apply filesystem-level restrictions (e.g., AppArmor or SELinux policy) on the conductor process to limit what files it can read. The trade-off of the filesystem restriction approach is operational overhead and potential breakage of legitimate provisioning workflows that depend on conductor file access.