CVE-2026-46447: OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

PriorityP344high7.7CVSS 3.1

AVNACLPRLUINSCCNIHAN

EPSS

0.26%

17.7th percentile

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
openstack	ironic	>= 17.0.0 < 26.1.7	26.1.7
openstack	ironic	>= 17.0.0 < 26.1.7	26.1.7
openstack	ironic	>= 27.0.0 < 29.0.6	29.0.6
openstack	ironic	>= 27.0.0 < 29.0.6	29.0.6
openstack	ironic	>= 30.0.0 < 32.0.2	32.0.2
openstack	ironic	>= 30.0.0 < 32.0.2	32.0.2
openstack	ironic	>= 33.0.0 < 35.0.2	35.0.2
openstack	ironic	>= 33.0.0 < 35.0.2	35.0.2
ubuntu	ironic	—	—

CVSS provenance

nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

vendor_ubuntu4.9MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.