CVE-2026-44916Disclosure(openstack / ironic)

LOWCVSS 3.0 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

openstack CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://bugs.launchpad.net/ironic/+bug/2148307

Weakness type (CWE)

CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ironic

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-05-08); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

openstack

Products

ironic

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Full discourse3 posts

Open Source Security mailing list@oss_security146d
Disclosure
OSSA-2026-012,CVE-2026-44916: OpenStack Ironic: Remote Code Execution when Anaconda driver enabled https://www.openwall.com/lists/oss-security/2026/05/11/7 Users who can set node.instance_info['ks_template'] can achieve RCE on the ironic-conductor process, as the template is rendered without sandboxing
Post summary
The passage announces a new Remote Code Execution flaw in OpenStack Ironic’s Anaconda driver. It highlights the vulnerability mechanism—unsandboxed rendering of ks_template—without indicating active exploitation or available patches.
02050687
4.7K followersView on X
CVE@CVEnew152d
Disclosure
CVE-2026-44916 In OpenStack Ironic through 35.x, instance_info['ks_template'] is rendered without sandboxing. https://www.cve.org/CVERecord?id=CVE-2026-44916
Post summary
The post discloses CVE-2026-44916 as an unsandboxed rendering issue in OpenStack Ironic, with no mention of PoC, exploit, active exploitation, or available fixes.
00000493
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds153d
Disclosure
CVE-2026-44916 Unsandboxed Template Rendering Vulnerability in OpenStack Ironic ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44916 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
Alert announcing CVE‑2026‑44916 as an unsandboxed template rendering flaw in OpenStack Ironic, with a link to more details.
0000039
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openstack	ironic	-	-	-

Explore more

Back to dashboard openstack CVEs ironic vulnerabilities