CVE-2026-44917 PUBLISHED

Assigner: mitre
Reserved: 08.05.2026 Published: 04.06.2026 Updated: 04.06.2026

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 4.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	OpenStack
Product	Ironic
Versions	Default: unaffected affected from 17.0.0 to 26.1.7 (excl.) affected from 27.0.0 to 29.0.6 (excl.) affected from 30.0.0 to 32.0.2 (excl.) affected from 33.0.0 to 35.0.2 (excl.)

References

https://bugs.launchpad.net/ironic/+bug/2148319
https://www.openwall.com/lists/oss-security/2026/06/03/13

Problem Types

CWE-669 Incorrect Resource Transfer Between Spheres CWE