OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-48681 · ADVISORY
• bugs.launchpad.net/ironic/+bug/2148333 · WEB
• openstack/ironic · PACKAGE
• openwall.com/lists/oss-security/2026/06/03/12 · WEB
• openwall.com/lists/oss-security/2026/06/03/12 · WEB
• pypi.org/project/ironic · PACKAGE
• GitHub Advisory GHSA-9v62-qx4c-44x5 · ADVISORY

ironic のその他の脆弱性

• CVE-2026-54421中 6.8In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return…
• CVE-2026-50589高 7.5In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or J…
• CVE-2026-46447高 7.7OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info…
• CVE-2026-44919中 6.5In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///…
• CVE-2026-42510高 7.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.