# ironic (PyPI) vulnerabilities 9 known vulnerabilities (7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pypi.org/project/ironic/ ## Advisories (9) ### [CVE-2026-54421](https://cve.now/CVE-2026-54421): In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can… - Severity: Medium 6.8 - Published: Jun 14, 2026 - Affected: from 17.0.0, fixed in 29.0.6; from 30.0.0, fixed in 32.0.2; from 33.0.0, fixed in 35.0.2; from 36.0.0, fixed in 37.0.1; from 17.0.0, fixed in 29.0.6; from 30.0.0, fixed in 32.0.2; from 33.0.0, fixed in 35.0.2; from 36.0.0, fixed in 37.0.1. ### [CVE-2026-50589](https://cve.now/CVE-2026-50589): In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or… - Severity: Medium 5.3 - Published: Jun 4, 2026 - Affected: from 32.0.0, fixed in 37.0.0; from 32.0.0, fixed in 37.0.0. ### [CVE-2026-48681](https://cve.now/CVE-2026-48681): OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. - Severity: Medium 5.9 - Published: Jun 4, 2026 - Affected: from 17.0.0, fixed in 26.1.7; from 27.0.0, fixed in 29.0.6; from 30.0.0, fixed in 32.0.2; from 33.0.0, fixed in 35.0.2; from 17.0.0, fixed in 26.1.7; from 27.0.0, fixed in 29.0.6; from 30.0.0, fixed in 32.0.2; from 33.0.0, fixed in 35.0.2. ### [CVE-2026-46447](https://cve.now/CVE-2026-46447): OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver\_info or… - Severity: Medium 5.8 - Published: Jun 3, 2026 - Affected: from 17.0.0, fixed in 26.1.7; from 27.0.0, fixed in 29.0.6; from 30.0.0, fixed in 32.0.2; from 33.0.0, fixed in 35.0.2; from 17.0.0, fixed in 26.1.7; from 27.0.0, fixed in 29.0.6; from 30.0.0, fixed in 32.0.2; from 33.0.0, fixed in 35.0.2. ### [CVE-2026-44919](https://cve.now/CVE-2026-44919): In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the… - Severity: Medium 4.3 - Published: May 14, 2026 - Affected: through 36.0.0; through 36.0.0. ### [CVE-2026-42510](https://cve.now/CVE-2026-42510): OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface. - Severity: Medium 6.6 - Published: Apr 28, 2026 - Affected: fixed in 35.0.1; fixed in 35.0.1. ### [CVE-2025-44021](https://cve.now/CVE-2025-44021): OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via… - Severity: Low 2.8 - Published: May 8, 2025 - Affected: fixed in 24.1.3; from 25.0.0, fixed in 26.1.1; from 27.0.0, fixed in 29.0.1; fixed in 24.1.3; from 25.0.0, fixed in 26.1.1; from 27.0.0, fixed in 29.0.1. ### [CVE-2024-47211](https://cve.now/CVE-2024-47211): In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a… - Severity: Medium 5.3 - Published: Oct 4, 2024 - Affected: from 25.0.0, fixed in 26.1.1; from 23.1.0, fixed in 24.1.3; from 22.0.0, fixed in 23.0.3; through 21.4.3; fixed in 23.0.3; from 23.1.0, fixed in 24.1.3; from 25.0.0, fixed in 26.1.1. ### [CVE-2016-4985](https://cve.now/CVE-2016-4985): The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain… - Severity: Unrated - Published: Jul 12, 2016 - Affected: fixed in 4.2.5; from 5.0, fixed in 5.1.2; fixed in 4.2.5; from 5.0, fixed in 5.1.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/ironic Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.