Executive brief
OpenStack Ironic is a service used to manage and provision physical (bare metal) servers. A vulnerability in how it handles boot templates allows an authorized project administrator or manager to read sensitive local files from the server running the Ironic service. This could lead to the exposure of configuration files containing credentials or other private system data, potentially allowing further unauthorized access to the infrastructure.
Technical details
A path traversal vulnerability exists in OpenStack Ironic's boot interface. The 'driver_info[pxe_template]' parameter is used as a template path without sufficient validation, allowing it to be pointed to arbitrary local files on the Ironic conductor host (e.g., /etc/ironic/ironic.conf). When the conductor renders the template using Jinja2, it reads the specified file and places the contents into a location accessible via TFTP or HTTP for netbooting. An attacker with 'baremetal:node:update:driver_info' permissions (typically a project admin or manager) can exploit this to extract sensitive files. The fix involves implementing an allowlist for permitted template directories and validating paths to prevent absolute path escapes.
Affected products
- OpenStack Ironic >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2
Timeline
- 2026-04-14: disclosed: Bug reported by Metal3.io security team
- 2026-06-03: advisory: OpenStack Security Advisory OSSA-2026-019 published
- 2026-06-04: patched: Fixed in version 35.0.2 and various backported releases