oss-security - [OSSA-2026-008] Ironic: Command Injection in IPMI Console Implementations (CVE pending)

Follow @Openwall on Twitter for new release announcements and other news

Message-ID: <9ca6dc44-f9a3-4700-be42-eac488a6c61c@jvf.cc>
Date: Mon, 27 Apr 2026 10:01:16 -0700
From: Jay Faulkner <jay@....cc>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2026-008] Ironic: Command Injection in IPMI Console
 Implementations (CVE pending)

=======================================================================
OSSA-2026-008: Command Injection in Ironic IPMI Console Implementations
=======================================================================

:Date: April 27, 2026
:CVE: CVE-2026-pending


Affects
~~~~~~~
- Ironic: >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1


Description
~~~~~~~~~~~
Dmitry Tantsur and Tuomo Tanskanen from the Metal3.io Security Team reported a vulnerability in Ironic's IPMI console backends. A project manager for the project marked as a ``node.owner`` can inject arbitrary commands which a conductor executes on console activation.

No console backends are enabled by default in Ironic. Only installations which have set ``[conductor]/enabled_console_interfaces`` to enable either ``ipmitool-shellinabox`` or ``ipmitool-socat`` are vulnerable.


Patches
~~~~~~~
-https://review.opendev.org/c/openstack/ironic/+/986418 (2023.1/antelope (unmaintained))
-https://review.opendev.org/c/openstack/ironic/+/986417 (2024.1/caracal (unmaintained))
-https://review.opendev.org/c/openstack/ironic/+/986363 (2024.2/dalmatian)
-https://review.opendev.org/c/openstack/ironic/+/986362 (2025.1/epoxy)
-https://review.opendev.org/c/openstack/ironic/+/986361 (2025.2/flamingo)
-https://review.opendev.org/c/openstack/ironic/+/986235 (2026.1/gazpacho)


Credits
~~~~~~~
- Dmitry Tantsur from Metal3.io Security Team
- Tuomo Tanskanen from Metal3.io Security Team


References
~~~~~~~~~~
-https://launchpad.net/bugs/2148331


Notes
~~~~~
- A CVE request was filed with MITRE on 2026-04-27.
- Patches for unmaintained branches are provided as a courtesy.
- The ``ipmitool-shellinabox`` console interface is already scheduled
   for removal from Ironic for lack of security support for shellinabox.
   Security sensitive operators are strongly encouraged to stop use of
   this console interface immediately.


Thanks,

Jay Faulkner
OpenStack Vulnerability Management Team
Ironic Security Liason



Content of type "text/html" skipped

Download attachment "OpenPGP_0x6B75D939B424C6D4.asc" of type "application/pgp-keys" (6373 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (496 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.