medium4.9
CVE-2026-44917
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
Impact
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openstack | Ironic | from 17.0.0 before 26.1.7 from 27.0.0 before 29.0.6 from 30.0.0 before 32.0.2 from 33.0.0 before 35.0.2 |