OpenStack Ironic <=35.0.x Boot Script Injection
CVE-2026-46447 Published on June 3, 2026
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
Vulnerability Analysis
CVE-2026-46447 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Products Associated with CVE-2026-46447
stack.watch emails you whenever new vulnerabilities are published in OpenStack Ironic or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
OpenStack Ironic:- Version 17.0.0 and below 26.1.7 is affected.
- Version 27.0.0 and below 29.0.6 is affected.
- Version 30.0.0 and below 32.0.2 is affected.
- Version 33.0.0 and below 35.0.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.