5.8 CVE-2026-46447

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
https://nvd.nist.gov/vuln/detail/CVE-2026-46447

Categories

CWE-669 : Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. Chain: router's firmware update procedure uses curl with "-k" (insecure) option that disables certificate validation (CWE-295), allowing adversary-in-the-middle (AITM) compromise with a malicious firmware image (CWE-494). PHP-based FAQ management app does not check the MIME type for uploaded images Some image editors modify a JPEG image, but the original EXIF thumbnail image is left intact within the JPEG. (Also an interaction error).

References

 

AFFECTED (from MITRE)

---

Vendor	Product	Versions
OpenStack	Ironic	17.0.0 < 26.1.7 [affected] 27.0.0 < 29.0.6 [affected] 30.0.0 < 32.0.2 [affected] 33.0.0 < 35.0.2 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe	start	end
Configuration 1
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*	>= 17.0.0	< 26.1.7
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*	>= 27.0.0	< 29.0.6
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*	>= 30.0.0	< 32.0.2
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*	>= 33.0.0	< 35.0.2

---

REMEDIATION

---

Patch

Url
https://security.openstack.org/ossa/OSSA-2026-017.html

---

EXPLOITS

---

Exploit-db.com

id	description	date
No known exploits

---

POC Github

Url
No known exploits

---

Other Nist (github, ...)

Url
No known exploits

---

CAPEC

---

Common Attack Pattern Enumerations and Classifications

id	description	severity
No entry

---