Approved changes feed: RSS · Atom
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Openstack (7b0cf974-b2b5-592e-bdf4-6953805ef02a) |
|---|---|
| Product | Ironic (d7fc3255-f207-5d72-a6a6-d75dd69242d3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/openstackhelm/ironic |
purl2cpe | 2026-06-01 10:17:03.709796 |
pkg:github/openstack/ironic |
purl2cpe | 2026-06-01 10:17:03.709799 |
pkg:pypi/ironic-python-agent |
purl2cpe | 2026-06-01 10:17:03.709801 |
pkg:rpm/opensuse/openstack-ironic |
purl2cpe | 2026-06-01 10:17:03.709804 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54423 |
vulnerable | 2026-07-29 01:00:27.807399 |
Details available
HIGH (8.2)
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
Published: 2026-07-10T03:10:54.638Z
Updated: 2026-07-10T15:25:59.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54421 |
vulnerable | 2026-07-29 01:00:27.805828 |
Details available
MEDIUM (6.8)
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
Published: 2026-06-14T03:49:37.996Z
Updated: 2026-06-16T22:38:18.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44918 |
vulnerable | 2026-07-29 00:52:14.918743 |
Details available
MEDIUM (5.5)
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
Published: 2026-07-10T00:00:00.000Z
Updated: 2026-07-10T14:31:59.215Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50589 |
under_investigation | 2026-06-08 08:07:02.837691 |
Details available
MEDIUM (5.3)
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
Published: 2026-06-04T23:59:20.118Z
Updated: 2026-07-16T12:04:41.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48681 |
vulnerable | 2026-06-08 08:05:12.309633 |
Details available
MEDIUM (5.9)
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
Published: 2026-06-04T00:00:00.000Z
Updated: 2026-06-04T12:54:13.785Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44919 |
vulnerable | 2026-06-08 08:05:11.379467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44917 |
vulnerable | 2026-06-08 08:05:11.379193 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44916 |
vulnerable | 2026-06-08 08:05:11.378833 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42997 |
vulnerable | 2026-06-08 08:03:17.003081 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42510 |
vulnerable | 2026-06-08 08:03:16.392327 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-44021 |
vulnerable | 2026-06-08 07:25:10.619849 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.