CVE-2026-42997
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in OpenStack Ironic before version 35.0.1 allows a user invoking 'molds' during import to request authorization to be sent to a remote endpoint. The forwarded credentials include a time-limited Keystone token (providing access to all OpenStack services Ironic is authorized for) or basic credentials configured for molds storage.
Risk Assessment
An attacker could intercept sensitive credentials (Keystone token or login credentials) sent to a remote endpoint, potentially leading to unauthorized access to the entire OpenStack infrastructure.
Recommendation
Immediately upgrade OpenStack Ironic to version 26.1.6, 29.0.5, 32.0.1, or 35.0.1, depending on the branch in use.
Other vulnerabilities in OpenStack Ironic
See all- CVE-2016-4985High
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
- CVE-2026-74250Medium
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
- CVE-2026-71201Medium
In OpenStack Ironic through 38.0.0, a project reader making a crafted request can return Portgroups assigned to Nodes owned or leased by another project.
- CVE-2026-54423High
In OpenStack Ironic before version 37.0.1, a user with the ability to deploy nodes via the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
- CVE-2026-44918Medium
A vulnerability in OpenStack Ironic before version 37.0.1 allows unauthorized creation or modification of nodes across projects. Lack of proper authorization enables an attacker to manipulate resources without required permissions.
- CVE-2026-54421Medium
In OpenStack Ironic before version 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials).
- CVE-2026-50589Medium
In OpenStack Ironic versions 32 through 37.0.0, an unauthenticated user can submit a crafted JSON string to some API or JSON-RPC endpoints, causing a service crash.
- CVE-2026-48681Medium
OpenStack Ironic before version 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
- CVE-2026-44917Medium
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
- CVE-2026-46447Medium
OpenStack Ironic before 35.0.2 allows iPXE script injection if the attacker can set node.driver_info or node.instance_info.
Original NVD description (English source)
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.