Vulnerability Details CVE-2026-46447
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.8%
CVSS Severity
CVSS v3 Score 5.8
References
Products affected by CVE-2026-46447
-
cpe:2.3:a:openstack:ironic:30.0.0
-
cpe:2.3:a:openstack:ironic:31.0.0
-
cpe:2.3:a:openstack:ironic:32.0.0
-
cpe:2.3:a:openstack:ironic:32.0.1
-
cpe:2.3:a:openstack:ironic:33.0.0
-
cpe:2.3:a:openstack:ironic:34.0.0
-
cpe:2.3:a:openstack:ironic:35.0.0
-
cpe:2.3:a:openstack:ironic:35.0.1