CVE-2026-46447 - Vulnerability Details - OpenCVE

ReportizFlow

OpenStack Ironic through 35.0.x allows Boot Script Injection.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Openstack	Ironic

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/06/03/11
https://bugs.launchpad.net/ironic/+bug/2150624
https://security.openstack.org/ossa/OSSA-2026-017.html

History

Thu, 04 Jun 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 04 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Title		Boot Script Injection via iPXE Script in OpenStack Ironic Node Configuration

Thu, 04 Jun 2026 07:15:00 +0000

Type	Values Removed	Values Added
Title	Boot Script Injection in OpenStack Ironic 35.0.x
Weaknesses	CWE-730

Thu, 04 Jun 2026 04:00:00 +0000

Type	Values Removed	Values Added
Description	OpenStack Ironic through 35.0.x allows Boot Script Injection.	OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
Weaknesses		CWE-669
CPEs		cpe:2.3:a:openstack:ironic::::::::
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N'}`

Wed, 03 Jun 2026 23:45:00 +0000

Type	Values Removed	Values Added
Title		Boot Script Injection in OpenStack Ironic 35.0.x
Weaknesses		CWE-730

Wed, 03 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openstack Openstack ironic
Vendors & Products		Openstack Openstack ironic

Wed, 03 Jun 2026 22:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/06/03/11

Wed, 03 Jun 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		OpenStack Ironic through 35.0.x allows Boot Script Injection.
References		https://bugs.launchpad.net/ironic/+bug/2150624 https://security.openstack.org/ossa/OSSA-2026-017.html

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-06-03T00:00:00.000Z

Updated: 2026-06-04T15:17:37.440Z

Reserved: 2026-05-14T00:00:00.000Z

Link: CVE-2026-46447

Vulnrichment

Updated: 2026-06-03T21:07:16.979Z

NVD

Status : Undergoing Analysis

Published: 2026-06-03T22:16:34.793

Modified: 2026-06-04T15:48:43.743

Link: CVE-2026-46447

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-46447", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-06-04T15:17:37.440Z", "dateReserved": "2026-05-14T00:00:00.000Z", "datePublished": "2026-06-03T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Ironic", "vendor": "OpenStack", "versions": [{"lessThan": "26.1.7", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "29.0.6", "status": "affected", "version": "27.0.0", "versionType": "semver"}, {"lessThan": "32.0.2", "status": "affected", "version": "30.0.0", "versionType": "semver"}, {"lessThan": "35.0.2", "status": "affected", "version": "33.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-04T03:18:40.368Z"}, "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2150624"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-017.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0.0", "versionEndExcluding": "26.1.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "27.0.0", "versionEndExcluding": "29.0.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "30.0.0", "versionEndExcluding": "32.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "33.0.0", "versionEndExcluding": "35.0.2"}]}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-03T21:07:16.979Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T15:15:09.125776Z", "id": "CVE-2026-46447", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T15:17:37.440Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-03T21:07:16.979Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T15:15:09.125776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T15:15:32.145Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenStack", "product": "Ironic", "versions": [{"status": "affected", "version": "17.0.0", "lessThan": "26.1.7", "versionType": "semver"}, {"status": "affected", "version": "27.0.0", "lessThan": "29.0.6", "versionType": "semver"}, {"status": "affected", "version": "30.0.0", "lessThan": "32.0.2", "versionType": "semver"}, {"status": "affected", "version": "33.0.0", "lessThan": "35.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2150624"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-017.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.1.7", "versionStartIncluding": "17.0.0"}, {"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.6", "versionStartIncluding": "27.0.0"}, {"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "32.0.2", "versionStartIncluding": "30.0.0"}, {"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "35.0.2", "versionStartIncluding": "33.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-04T03:18:40.368Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46447", "state": "PUBLISHED", "dateUpdated": "2026-06-04T15:17:37.440Z", "dateReserved": "2026-05-14T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-06-03T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}