Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-42997: OpenStack Ironic idrac Exposes User Credentials
CVE-2026-42997 · published 6 months ago
Summary
A user's credentials can be sent to a remote endpoint when importing certain data. This could allow unauthorized access to OpenStack services. Update to version 26.1.6, 29.0.5, 32.0.1, or 35.0.1 to fix this issue.
What to do
- Update openstack ironic-python-agent to version 35.0.1.
- Update openstack ironic-python-agent to version 32.0.1.
- Update openstack ironic-python-agent to version 29.0.5.
- Update openstack ironic-python-agent to version 26.1.6.
- Update debian ironic to version 1:35.0.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | ironic | All versions |
| Debian:14 | debian | ironic |
< 1:35.0.1-1 Fix: upgrade to 1:35.0.1-1
|
| Debian:11 | debian | ironic | All versions |
| Debian:12 | debian | ironic | All versions |
| pip | openstack | ironic-python-agent |
>= 33.0.0, < 35.0.1 >= 30.0.0, < 32.0.1 >= 27.0.0, < 29.0.5 < 26.1.6 Fix: upgrade to 35.0.1
|
| – | openstack | ironic |
< 26.1.6 >= 17.0.0, < 26.1.6 >= 27.0.0, < 29.0.5 >= 30.0.0, < 32.0.1 >= 33.0.0, < 35.0.1 |
| Ubuntu:16.04:LTS | canonical | ironic | All versions |
Original advisory text
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
References
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42997.json URL
- https://security.openstack.org/ossa/OSSA-2026-010.html URL
- https://access.redhat.com/errata/RHSA-2026:39811 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-42997 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42997... Vendor Advisory
- https://www.openwall.com/lists/oss-security/2026/05/05/10 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-42997 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42997 Vendor Advisory
- https://github.com/advisories/GHSA-54w4-233h-x86g
- https://github.com/openstack/ironic-python-agent Product
- https://pypi.org/project/ironic-python-agent Product
- https://ubuntu.com/security/CVE-2026-42997 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-42997 Third Party Advisory
- https://bugs.launchpad.net/ironic/+bug/2148317 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/05/10 URL
- https://bugzilla.redhat.com/show_bug.cgi?id=2466844 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-669Incorrect Resource Transfer Between Spheres
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published5 May 2026
Updated4 Nov 2026
First seen5 May 2026
Sources
DEBIAN-CVE-2026-42997 · OSV
CVE-2026-42997 · NVD
GHSA-54w4-233h-x86g · GHSA
CVE-2026-42997 · MITRE
PYSEC-2026-2526 · OSV
CVE-2026-42997 · OSV
UBUNTU-CVE-2026-42997 · OSV
Track software like this
Free during beta