CVE-2026-42510: OpenStack Ironic command injection in IPMI console interfaces

CVE-2026-42510 · Severity: medium · CVSS 6.6 · Published 2026-04-28

OpenStack Ironic, a service for managing bare metal hardware, contains a vulnerability that could allow an authorized user to execute unauthorized commands on the management server. This occurs when specific console interfaces (shellinabox or socat) are enabled, allowing a user with 'node owner' privileges to compromise the underlying host during console activation. While this requires high privileges and a non-default configuration, it could lead to full control over the infrastructure management layer.

Technologies: OpenStack Ironic, ironic (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-42510 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42510 being exploited in the wild.
How severe is CVE-2026-42510?
Medium severity, with a CVSS score of 6.6, published 28 April 2026.
Which products and versions are affected?
OpenStack Ironic >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1; ironic (PyPI) ECOSYSTEM:introduced=0,fixed=35.0.1.
Is there a fix for CVE-2026-42510?
Yes. ironic (PyPI): upgrade to 35.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42510 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42510?
Check whether you run OpenStack Ironic or ironic (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ironic (PyPI): upgrade to 35.0.1 or later
    pip install "ironic>=35.0.1"

Technical details

A command injection vulnerability exists in OpenStack Ironic's IPMI console backends (ipmitool-shellinabox and ipmitool-socat). The root cause is the improper sanitization of driver_info fields (such as ipmi_address) which are concatenated into a command string and passed to socat's EXEC or shellinaboxd without adequate shell escaping. An attacker with 'node.owner' or 'system member' privileges can inject shell metacharacters into these fields. When the console is subsequently activated, the injected commands are executed with the privileges of the ironic-conductor process. The vulnerability is only present in non-default configurations where these specific console interfaces are enabled. Patches have been released across multiple release branches including Dalmatian, Epoxy, Flamingo, and Gazpacho.

Affected products

  • OpenStack Ironic >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1

Identifiers

  • CVE-2026-42510
  • GHSA-wqpv-c3pp-3m58
  • PYSEC-2026-2525

Timeline

  • 2026-04-14: other: Vulnerability reported to OpenStack via Launchpad
  • 2026-04-27: advisory: Original OSSA-2026-008 advisory published
  • 2026-04-28: disclosed: Public disclosure and CVE assignment
  • 2026-04-29: patched: Patches released for supported branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.