VulnSocial

CVE-2026-46447General(openstack / ironic)

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch openstack ironic systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

openstack CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-669

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ironic

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-06-03); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
openstack
Products
ironic

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-07: 1Mentions · 2026-06-16: 1Patch / Workaround · 2026-06-16: 1Technical Details · 2026-06-07: 1Technical Details · 2026-06-16: 106-0306-0706-16
Signal classification3 categories
General
133.3%
Disclosure
133.3%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-031
General1
2026-06-071
Disclosure1
2026-06-161
Patch1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    OpenStack OSSA-2026-017: Ironic: Script injection during node boot via linux command line override (CVE-2026-46447) https://www.openwall.com/lists/oss-security/2026/06/03/11 OSSA-2026-018: Ironic: File overwrite on Ironic conductor via path traversal in ISO handling (CVE-2026-48681) https://www.openwall.com/lists/oss-security/2026/06/03/12

    Post summary

    The snippet announces two new OpenStack Ironic vulnerabilities, providing short technical details but no proof of concept, exploit code, or patch information.

    100301.0K
    4.7K followersView on X
  • Can Artuc@canartuc
    Patch

    OpenStack Ironic re-issued its fix for CVE-2026-46447 after the first patches wrongly rejected valid URL-encoded kernel parameters. The flaw let a user editing node fields inject iPXE scripts at boot. Apply both rounds across Ironic 17.0.0 to 35.0.1. Run bare-metal Ironic?

    Post summary

    The post announces that OpenStack Ironic re-issued a patch for CVE-2026-46447, correcting an earlier patch that incorrectly rejected URL-encoded kernel parameters and clarifies the vulnerability allows iPXE script injection via node field editing.

    0000032
    171 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-46447 [OSSA-2026-017] Ironic https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46447

    Post summary

    The snippet references CVE‑2026‑46447 with a link to a vulnerability detail page but offers no additional context such as PoC, exploit, patch, or technical specifics.

    0000037
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenstackironic---

Explore more

Back to dashboardopenstack CVEsironic vulnerabilities