| CVE-2026-90458 |
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's…
|
5.4
Medium
|
Oct 23, 2026 |
| CVE-2026-89419 |
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to…
|
5.0
Medium
|
Oct 23, 2026 |
| CVE-2026-115638 |
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of…
|
4.3
Medium
|
Oct 23, 2026 |
| CVE-2026-90461 |
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is…
|
6.3
Medium
|
Sep 11, 2026 |
| CVE-2026-74250 |
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment…
|
6.3
Medium
|
Aug 14, 2026 |
| CVE-2026-71201 |
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups…
|
5.0
Medium
|
Aug 5, 2026 |
| CVE-2026-54423 |
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface…
|
8.2
High
|
Jul 10, 2026 |
| CVE-2026-44918 |
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization
|
5.5
Medium
|
Jul 10, 2026 |
| CVE-2026-54421 |
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized…
|
6.8
Medium
|
Jun 14, 2026 |
| CVE-2026-50589 |
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some…
|
5.3
Medium
|
Jun 4, 2026 |
| CVE-2026-44917 |
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the…
|
4.9
Medium
|
Jun 4, 2026 |
| CVE-2026-48681 |
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted…
|
5.9
Medium
|
Jun 4, 2026 |
| CVE-2026-46447 |
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info…
|
5.8
Medium
|
Jun 3, 2026 |
| CVE-2026-44919 |
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can…
|
4.3
Medium
|
May 14, 2026 |
| CVE-2026-44916 |
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered…
|
3.0
Low
|
May 8, 2026 |
| CVE-2026-42997 |
An issue was discovered in idrac in OpenStack Ironic before 35.0.1
|
7.7
High
|
May 5, 2026 |
| CVE-2026-42510 |
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface
|
6.6
Medium
|
Apr 28, 2026 |
| CVE-2025-44021 |
OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment…
|
2.8
Low
|
May 8, 2025 |