Vulnerability Details CVE-2026-44917
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 20.5%
CVSS Severity
CVSS v3 Score 4.9
References
Products affected by CVE-2026-44917
-
cpe:2.3:a:openstack:ironic:30.0.0
-
cpe:2.3:a:openstack:ironic:31.0.0
-
cpe:2.3:a:openstack:ironic:32.0.0
-
cpe:2.3:a:openstack:ironic:32.0.1
-
cpe:2.3:a:openstack:ironic:33.0.0
-
cpe:2.3:a:openstack:ironic:34.0.0
-
cpe:2.3:a:openstack:ironic:35.0.0
-
cpe:2.3:a:openstack:ironic:35.0.1