p PatchFirst

CVE-2026-46447

CVE-2026-46447

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

CVSS 5.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • ironic

    Versions
    • ≥ 17.0.0, < 26.1.7: Affected (semver)
    • ≥ 27.0.0, < 29.0.6: Affected (semver)
    • ≥ 30.0.0, < 32.0.2: Affected (semver)
    • ≥ 33.0.0, < 35.0.2: Affected (semver)

    Update to 26.1.7; Update to 29.0.6; Update to 32.0.2; Update to 35.0.2

  • ironic Debian:12

    Versions
    • 1:21.1.0-3
    • 1:21.1.0-3+deb12u1
    • 1:21.3.0-1
    • 1:21.4.0-1
    • 1:21.4.0-2
    • 1:21.4.0-3
    • 1:21.4.0-4
    Affected ranges
    • ECOSYSTEM: < 1:21.4.4-0+deb12u1

    Update to 1:21.4.4-0+deb12u1

  • ironic Debian:13

    Versions
    • 1:29.0.0-7
    • 1:29.0.5-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1:29.0.5-0+deb13u2

    Update to 1:29.0.5-0+deb13u2

  • ironic Debian:14

    Versions
    • 1:29.0.0-7
    • 1:32.0.0-1
    • 1:32.0.0-2
    • 1:32.0.0-4
    • 1:32.0.0-5
    • 1:32.0.0-6
    • 1:32.0.0-7
    • 1:34.0.0-1
    • 1:35.0.0-1
    • 1:35.0.0-2
    • 1:35.0.1-1
    • 1:35.0.1-2
    • 1:35.0.1-3
    Affected ranges
    • ECOSYSTEM: < 1:35.0.1-5

    Update to 1:35.0.1-5

  • ironic PyPI

    Versions
    • 17.0.0
    • 17.0.1
    • 17.0.2
    • 17.0.3
    • 17.0.4
    • 17.1.0
    • 18.0.0
    • 18.1.0
    • 18.2.0
    • 18.2.1
    • 18.2.2
    • 18.3.0
    • 19.0.0
    • 20.0.0
    • 20.1.0
    • 20.1.1
    • 20.1.2
    • 20.1.3
    • 20.2.0
    • 21.0.0
    • 21.1.0
    • 21.1.1
    • 21.1.2
    • 21.2.0
    • 21.3.0
    • 21.4.0
    • 21.4.1
    • 21.4.2
    • 21.4.3
    • 21.4.4
    • 22.0.0
    • 22.1.0
    • 23.0.0
    • 23.0.1
    • 23.0.2
    • 23.0.3
    • 23.0.4
    • 23.0.5
    • 23.1.0
    • 24.0.0
    • 24.1.0
    • 24.1.1
    • 24.1.2
    • 24.1.3
    • 24.1.4
    • 24.1.5
    • 25.0.0
    • 26.0.0
    • 26.1.0
    • 26.1.1
    • 26.1.2
    • 26.1.3
    • 26.1.4
    • 26.1.5
    • 26.1.6
    Affected ranges
    • ECOSYSTEM: ≥ 17.0.0, < 26.1.7

    Update to 26.1.7

  • ironic PyPI

    Versions
    • 27.0.0
    • 28.0.0
    • 29.0.0
    • 29.0.1
    • 29.0.2
    • 29.0.3
    • 29.0.4
    • 29.0.5
    Affected ranges
    • ECOSYSTEM: ≥ 27.0.0, < 29.0.6

    Update to 29.0.6

  • ironic PyPI

    Versions
    • 30.0.0
    • 31.0.0
    • 32.0.0
    • 32.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 30.0.0, < 32.0.2

    Update to 32.0.2

  • ironic PyPI

    Versions
    • 33.0.0
    • 34.0.0
    • 35.0.0
    • 35.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 33.0.0, < 35.0.2

    Update to 35.0.2

  • ironic PyPI

    Versions
    • 17.0.0
    • 17.0.1
    • 17.0.2
    • 17.0.3
    • 17.0.4
    • 17.1.0
    • 18.0.0
    • 18.1.0
    • 18.2.0
    • 18.2.1
    • 18.2.2
    • 18.3.0
    • 19.0.0
    • 20.0.0
    • 20.1.0
    • 20.1.1
    • 20.1.2
    • 20.1.3
    • 20.2.0
    • 21.0.0
    • 21.1.0
    • 21.1.1
    • 21.1.2
    • 21.2.0
    • 21.3.0
    • 21.4.0
    • 21.4.1
    • 21.4.2
    • 21.4.3
    • 21.4.4
    • 22.0.0
    • 22.1.0
    • 23.0.0
    • 23.0.1
    • 23.0.2
    • 23.0.3
    • 23.0.4
    • 23.0.5
    • 23.1.0
    • 24.0.0
    • 24.1.0
    • 24.1.1
    • 24.1.2
    • 24.1.3
    • 24.1.4
    • 24.1.5
    • 25.0.0
    • 26.0.0
    • 26.1.0
    • 26.1.1
    • 26.1.2
    • 26.1.3
    • 26.1.4
    • 26.1.5
    • 26.1.6
    • 27.0.0
    • 28.0.0
    • 29.0.0
    • 29.0.1
    • 29.0.2
    • 29.0.3
    • 29.0.4
    • 29.0.5
    • 30.0.0
    • 31.0.0
    • 32.0.0
    • 32.0.1
    • 33.0.0
    • 34.0.0
    • 35.0.0
    • 35.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 17.0.0, < 26.1.7 ∪ ≥ 27.0.0, < 29.0.6 ∪ ≥ 30.0.0, < 32.0.2 ∪ ≥ 33.0.0, < 35.0.2

    Update to 26.1.7; Update to 29.0.6; Update to 32.0.2; Update to 35.0.2

  • ironic Ubuntu:22.04:LTS

    Versions
    • 1:18.2.0-0ubuntu1
    • 1:18.2.0+git2021120910.cdc3b9538-0ubuntu1
    • 1:19.0.0+git2022011216.7beadee46-0ubuntu1
    • 1:20.0.0+git2022030313.4e6a3d52e-0ubuntu1
    • 1:20.1.0-0ubuntu1
    • 1:20.1.0-0ubuntu1.1
    • 1:20.1.0-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 1:20.1.0-0ubuntu1.3

    Update to 1:20.1.0-0ubuntu1.3

  • ironic Ubuntu:24.04:LTS

    Versions
    • 1:23.0.0-0ubuntu3
    • 1:23.1.0+git2024011916.a374a0c1-0ubuntu1
    • 1:24.1.0-0ubuntu1
    • 1:24.1.1-0ubuntu1
    • 1:24.1.1-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 1:24.1.1-0ubuntu1.3

    Update to 1:24.1.1-0ubuntu1.3

  • ironic Ubuntu:25.10

    Versions
    • 1:29.0.0-0ubuntu1
    • 1:30.0.0+git2025070713.577833d78-0ubuntu1
    • 1:30.0.0+git2025070713.577833d78-0ubuntu2
    • 1:32.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1:32.0.0-0ubuntu1.1

    Update to 1:32.0.0-0ubuntu1.1

  • ironic Ubuntu:26.10

    Versions
    • 1:35.0.0-0ubuntu2
    • 1:35.0.0-0ubuntu3
    • 1:38.0.0+git20260818.101.f8e78b0-0ubuntu1
    • 1:38.0.0+git2026091517.26c022f13-0ubuntu1
    • 1:39.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:26.04:LTS

    Versions
    • 1:32.0.0-0ubuntu1
    • 1:34.0.0-0ubuntu1
    • 1:35.0.0-0ubuntu1
    • 1:35.0.0-0ubuntu2
    Affected ranges
    • ECOSYSTEM: < 1:35.0.0-0ubuntu2.1

    Update to 1:35.0.0-0ubuntu2.1

Original sources

Check your server →