low3.0
CVE-2026-44916
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
Impact
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openstack | Ironic | from 17.0.0 before 26.1.7 from 27.0.0 before 29.0.6 from 30.0.0 before 32.0.2 from 33.0.0 before 35.0.2 |