CVSS 3.1
7.7 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:NCVE-2026-46447
High (7.7) in openstack ironic. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in ironic 26.1.7, 29.0.6, 32.0.2.
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
- CWE
- CWE-669
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:ironic
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jrh2-f5jc-xpgr | PyPI | ironic | >=17.0.0 <26.1.7 | 26.1.7 |
| GHSA-jrh2-f5jc-xpgr | PyPI | ironic | >=27.0.0 <29.0.6 | 29.0.6 |
| GHSA-jrh2-f5jc-xpgr | PyPI | ironic | >=30.0.0 <32.0.2 | 32.0.2 |
| GHSA-jrh2-f5jc-xpgr | PyPI | ironic | >=33.0.0 <35.0.2 | 35.0.2 |
| PYSEC-2026-3471 | PyPI | ironic | >=17.0.0 <26.1.7 >=27.0.0 <29.0.6 >=30.0.0 <32.0.2 >=33.0.0 <35.0.2 | 26.1.7, 29.0.6, 32.0.2, 35.0.2 |