7.7
High
CVE-2026-42997 An issue was discovered in idrac in OpenStack Ironic before 35.0.1
Description
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ironic 33.0 | 33.0.0 → < 35.0.1 | 35.0.1 |
| Ironic 30.0 | 30.0.0 → < 32.0.1 | 32.0.1 |
| Ironic 27.0 | 27.0.0 → < 29.0.5 | 29.0.5 |
| Ironic 17.0 | 17.0.0 → < 26.1.6 | 26.1.6 |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published |
References
- www.openwall.com www.openwall.com
- security.openstack.org security.openstack.org
Timeline
- Published
- Last modified
Other CVEs of Ironic
The 18 CVEs of Ironic →
CVE-2026-90458
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's…
5.4
Medium
CVE-2026-89419
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to…
5.0
Medium
CVE-2026-115638
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of…
4.3
Medium
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is…
6.3
Medium