Red Hat OpenStack Platform 16.2/openstack-ironic

Red Hat · Package

11 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume propertiesCVE-2026-54421 · GHSA-J4CW-MCG2-2Q78Version ranges need review.	ironic Red Hat OpenShift Container Platform 4/openstack-ironic	PyPIRed Hat	Medium	Fix reported	2026-09-10
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control SphereCVE-2026-42510 · GHSA-WQPV-C3PP-3M58Version ranges need review.	ironic Red Hat OpenShift Container Platform 4/openstack-ironic	PyPIRed Hat	Medium	Fix reported	2026-09-10
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO imageCVE-2026-48681 · GHSA-9V62-QX4C-44X5Version ranges need review.	ironic Red Hat OpenShift Container Platform 4/openstack-ironic	PyPIRed Hat	Medium	Fix reported	2026-07-23
OpenStack Ironic allows Boot Script InjectionCVE-2026-46447 · GHSA-JRH2-F5JC-XPGRVersion ranges need review.	ironic Red Hat OpenShift Container Platform 4/openstack-ironic	PyPIRed Hat	Medium	Fix reported	2026-07-23
OpenStack Ironic fails to restrict paths used for file:// image URLsCVE-2025-44021 · GHSA-Q3M2-CRGQ-5P3QVersion ranges need review.	ironic Red Hat OpenShift Container Platform 4/openstack-ironic	PyPIRed Hat	Low	Fix reported	2026-06-10
openstack-ironic: openstack-ironic: Denial of Service via decompression bomb in configdriveCVE-2026-115638	Red Hat OpenShift Container Platform 4/openstack-ironic Red Hat OpenStack Platform 13 (Queens)/openstack-ironic	Red Hat	Medium	No fix reported	Not recorded
openstack-ironic: ironic: Sensitive information disclosure via arbitrary PXE template pathCVE-2026-44917	Red Hat OpenShift Container Platform 4/openstack-ironic Red Hat OpenStack Platform 13 (Queens)/openstack-ironic	Red Hat	Medium	No fix reported	Not recorded
ironic: OpenStack Ironic: Information disclosure via crafted requestCVE-2026-71201	Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel8-operator Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel9-operator	Red Hat	Medium	No fix reported	Not recorded
ironic: OpenStack Ironic: Information disclosure via unexpected credential transmissionCVE-2026-90461	Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9 Red Hat OpenShift Container Platform 4/openstack-ironic	Red Hat	Medium	No fix reported	Not recorded
openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCHCVE-2026-89419	Red Hat OpenShift Container Platform 4/openshift4/ose-ironic-rhel9 Red Hat OpenShift Container Platform 4/openstack-ironic	Red Hat	Medium	No fix reported	Not recorded
openstack-ironic: openstack-ironic: Redfish vendor_passthru subscription id path traversalCVE-2026-90458	Red Hat OpenShift Container Platform 4/openstack-ironic Red Hat OpenStack Platform 13 (Queens)/openstack-ironic	Red Hat	Medium	No fix reported	Not recorded