GitHub Advisoryadvisory · PyPI

GHSA-jrh2-f5jc-xpgr OpenStack Ironic allows Boot Script Injection

MEDIUM Published 2026-06-04 Modified 2026-07-14 Official page ↗
Aliases
CVE-2026-46447
Ecosystem
PyPI
Packages
ironic
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-669
Reviewed
2026-07-14

Affected packages

• PyPI ironic: >= 17.0.0, < 26.1.7 → fixed in 26.1.7 • PyPI ironic: >= 27.0.0, < 29.0.6 → fixed in 29.0.6 • PyPI ironic: >= 30.0.0, < 32.0.2 → fixed in 32.0.2 • PyPI ironic: >= 33.0.0, < 35.0.2 → fixed in 35.0.2

Description

OpenStack Ironic through 35.0.x allows Boot Script Injection.

Related

Alias · CVE (1)

  • CVE-2026-46447 OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or… vulnerability

Weakness · CWE (1)

  • CWE-669 Incorrect Resource Transfer Between Spheres weakness

References