https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T23:23:26.434790+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44917 CVE-2026-44917 2026-10-07T23:23:26.472136+00:00

Affected: OpenStack Ironic

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

 https://cve.radiocsirt.org/vuln/usn-8421-1 USN-8421-1 — ironic vulnerabilities 2026-10-07T23:23:26.472195+00:00

Affected: Ubuntu:22.04:LTS: ironic, Ubuntu:24.04:LTS: ironic, Ubuntu:25.10: ironic, Ubuntu:26.04:LTS: ironic

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor. (CVE-2026-48681)

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate kernel command line parameters. A privileged authenticated remote user could use this issue to inject scripts during node boot and possibly execute arbitrary code. (CVE-2026-46447)

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic incorrectly restricted access to custom PXE templates. A privileged authenticated remote user could use this issue to read arbitrary sensitive files on the Ironic conductor. (CVE-2026-44917)