OpenStack Ironic ks_template unsandboxed rendering
CVE-2026-44916 Published on May 8, 2026
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
Vulnerability Analysis
CVE-2026-44916 is exploitable with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE
Weakness Type
CWE-1336
Products Associated with CVE-2026-44916
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 17.0.0 and below 26.1.7 is affected.
- Version 27.0.0 and below 29.0.6 is affected.
- Version 30.0.0 and below 32.0.2 is affected.
- Version 33.0.0 and below 35.0.2 is affected.