Executive brief
OpenStack Ironic is a bare metal provisioning service used to manage and deploy physical servers. When configured to use HTTP Basic Authentication for image downloads, a vulnerability allows an authenticated tenant to cause the system to send the operator's global image server credentials to an attacker-controlled URL, exposing sensitive authentication secrets and enabling unauthorized access to all images on the image server.
Technical details
The vulnerability exists in ironic/common/image_service.py where the service returns the operator's static HTTP Basic Auth credentials whenever `image_server_auth_strategy` is set to `http_basic`, without validating the target image URL hostname. A Keystone-authenticated tenant can exploit this by setting `instance_info.image_checksum` or `instance_info.image_source` to point to an attacker-controlled URL, then triggering a deploy or validate state transition. When the conductor fetches the image, it sends the Authorization: Basic header containing the operator's credentials to the attacker's endpoint on the first hop. The vulnerability requires an authenticated tenant with node control capabilities and affects Ironic through version 38.0.0. The issue is caused by missing allowlist validation on tenant-controlled URLs, in contrast to similar functionality in the OCI registry handler.
Affected products
- OpenStack Ironic through 38.0.0
Timeline
- 2026-08-04: disclosed
- 2026-09-11: advisory