VulnSocial

CVE-2026-48681Disclosure(openstack / ironic)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

openstack CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-23

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ironic

Threat summary

  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-06-03); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
openstack
Products
ironic

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-04: 1Mentions · 2026-06-07: 1Technical Details · 2026-06-04: 1Technical Details · 2026-06-07: 106-0306-0406-07
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-031
General1
2026-06-041
Disclosure1
2026-06-071
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    OpenStack OSSA-2026-017: Ironic: Script injection during node boot via linux command line override (CVE-2026-46447) https://www.openwall.com/lists/oss-security/2026/06/03/11 OSSA-2026-018: Ironic: File overwrite on Ironic conductor via path traversal in ISO handling (CVE-2026-48681) https://www.openwall.com/lists/oss-security/2026/06/03/12

    Post summary

    The post announces two new OpenStack Ironic vulnerabilities (CVE‑2026‑46447 and CVE‑2026‑48681) and briefly describes their impact.

    100301.0K
    4.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48681 OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. https://www.cve.org/CVERecord?id=CVE-2026-48681

    Post summary

    The text announces a directory‑traversal based file overwrite vulnerability in OpenStack Ironic before v35.0.2, triggered by a crafted ISO image. No PoC, exploit, patch, or active exploitation details are provided.

    00000142
    57.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-48681 [OSSA-2026-018] Ironic https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48681

    Post summary

    The text only lists CVE‑2026‑48681 and a link to vulmon, offering no further context or details.

    0000039
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenstackironic---

Explore more

Back to dashboardopenstack CVEsironic vulnerabilities