Openstack Ironic vulnerabilities
23 known vulnerabilities affecting openstack/ironic.
Total CVEs
23
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH7MEDIUM13LOW2UNKNOWN1
Vulnerabilities
Page 2 of 2
CVE-2026-115638P4MEDIUMCVSS 4.3≥ 30.0.0, ≤ 32.1.1≥ 33.0.0, ≤ 35.1.1+1 more2026-10-23
CVE-2026-115638 [MEDIUM] CWE-409 CVE-2026-115638: OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
nvd
CVE-2026-44916P4LOWCVSS 3.0≥ 17.0.0, < 26.1.7≥ 27.0.0, < 29.0.6+2 more2026-05-08
CVE-2026-44916 [LOW] CWE-1336 CVE-2026-44916: In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_templa
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
nvd
CVE-2025-44021P4LOWCVSS 2.8≥ 24, < 24.1.3≥ 25, < 26.1.1+1 more2025-05-08
CVE-2025-44021 [LOW] CWE-22 CVE-2025-44021: OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handlin
OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, b
ghsanvdosv
← Previous2 / 2