EUVD-2026-76751
GHSA-mpf9-7jmw-7hrh
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
AC:H reflects the redirect/URL-manipulation precondition; PR:L requires authenticated OpenStack access; S:C and C:H capture credential leakage to an external unauthorized host.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
AnalysisAI
OpenStack Ironic through version 38.0.0 leaks HTTP Basic Authentication credentials to unintended remote hosts during image retrieval, when the Image Service is configured to use HTTP(S) Basic Authentication. An authenticated, low-privileged attacker who can influence image fetch operations or position a rogue endpoint in the network path can capture plaintext usernames and passwords belonging to the Image Service account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the OpenStack Image Service must be explicitly configured to use HTTP or HTTPS Basic Authentication - this is a non-default operator choice, and deployments using Keystone token authentication are not affected; (2) the attacker must be able to influence the URL used by Ironic for image retrieval, either by injecting a malicious image reference, exploiting an HTTP redirect from the legitimate Image Service endpoint, or performing a network-level redirect (e.g., ARP/DNS spoofing on a shared segment). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N yields a base score of 6.3, which appropriately reflects several real-world constraints: AC:H indicates exploitation requires specific conditions (redirect or URL manipulation), PR:L requires the attacker to have some authenticated foothold, and the High Confidentiality impact with Scope Changed correctly captures that the leaked credentials expose the Image Service account rather than just local Ironic data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade OpenStack Ironic to a version beyond 38.0.0 once a patched release is confirmed - monitor the upstream Launchpad bug at https://bugs.launchpad.net/ironic/+bug/2162816 and the OpenStack Security Advisories channel for the official fix version, as no specific remediated release was identified in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today