IR
Product
Ironic
18
CVEs
0
On KEV
8.2
Max CVSS
3
New 30D
Severity mix
Critical 0High 6Medium 11Low 1
Watch
Add Ironic to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-54423 | 8.2 | Jul 10 | In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI… Affected: 22.1.0 before 29.0.6; 30.0.0 before 32.0.2; 32.0.0 before 35.0.2; 36.0.0 before 37.0.1 |
| CVE-2026-48681 | 8.1 | Jun 4 | OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image Affected: 17.0.0 before 26.1.7; 27.0.0 before 29.0.6; 30.0.0 before 32.0.2; 33.0.0 before 35.0.2 |
| CVE-2026-46447 | 7.7 | Jun 3 | OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info Affected: 17.0.0 before 26.1.7; 27.0.0 before 29.0.6; 30.0.0 before 32.0.2; 33.0.0 before 35.0.2 |
| CVE-2026-42997 | 7.7 | May 5 | An issue was discovered in idrac in OpenStack Ironic before 35.0.1 Affected: 17.0.0 before 26.1.6; 27.0.0 before 29.0.5; 30.0.0 before 32.0.1; 33.0.0 before 35.0.1 |
| CVE-2026-50589 | 7.5 | Jun 4 | In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service… Affected: 32.0.0 before 37.0.0 |
| CVE-2026-42510 | 7.2 | Apr 28 | OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface Affected: 4.3.0 before 26.1.6; 27.0.0 before 29.0.5; 30.0.0 before 32.0.1; 33.0.0 before 35.0.1 |
Showing 6