Executive brief
OpenStack Ironic is a service used to manage and provision physical hardware (bare metal) servers. A security flaw allows users with permission to deploy or maintain servers to bypass safety controls and send raw, low-level commands directly to a server's hardware management controller (BMC). This could allow an attacker to gain persistent access to the hardware, modify network settings, or disrupt the server's availability.
Technical details
A vulnerability in OpenStack Ironic's IPMI management interface allows users with the ability to initiate deployment, cleaning, or servicing flows to execute arbitrary IPMI commands. The 'send_raw' step, located in the ipmitool driver, was registered as a valid step for deployment and maintenance without sufficient RBAC distinction. While administrative interfaces like VendorPassthru are restricted, this flaw allows a project member with 'set_provision_state' permissions to include malicious IPMI payloads in manual cleaning or service steps. An attacker can use this to modify BMC users, alter network configurations, or ensure persistent out-of-band access. The issue is addressed in version 37.0.1 and various backported patches by implementing a blocklist for the send_raw functionality in specific provisioning methods.
Affected products
- OpenStack Ironic >=22.1.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1
Timeline
- 2026-04-27: disclosed: Bug reported by Metal3.io security team
- 2026-07-08: advisory: OpenStack Security Advisory OSSA-2026-025 published
- 2026-07-10: patched: CVE published and fix confirmed in version 37.0.1