Ironic vulnerabilities
CVEs whose affected-version data names the Ironic package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
13 CVEsRSS
CVE-2026-89419Medium· 5.0OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
CVE-2026-115638Medium· 4.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
CVE-2026-90458Medium· 5.4OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
CVE-2026-90461Medium· 6.3OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
CVE-2026-54421Medium· 6.8OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
CVE-2026-50589Medium· 5.3OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
CVE-2026-46447Medium· 5.8OpenStack Ironic allows Boot Script Injection
OpenStack Ironic allows Boot Script Injection
CVE-2026-48681Medium· 5.9OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
CVE-2026-44919Medium· 4.3OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
CVE-2026-42997High· 7.7An issue was discovered in idrac in OpenStack Ironic before 35.0.1
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides…
CVE-2026-42510Medium· 6.6OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
CVE-2024-47211Medium· 5.3OpenStack Ironic fails to verify checksums of supplied image_source URLs
OpenStack Ironic fails to verify checksums of supplied image_source URLs
CVE-2016-4985High· 7.5OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor
OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor