OpenStack Ironic ks_template unsandboxed rendering
CVE-2026-44916 Published on May 8, 2026
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
Vulnerability Analysis
CVE-2026-44916 is exploitable with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Products Associated with CVE-2026-44916
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 17.0.0 and below 26.1.7 is affected.
- Version 27.0.0 and below 29.0.6 is affected.
- Version 30.0.0 and below 32.0.2 is affected.
- Version 33.0.0 and below 35.0.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.