CVE-2026-42510CWE-829

CVE-2026-42510

Medium · published April 28, 2026

CVSS v3.1
6.6
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00741 · 54.1th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-04-28T10:16Z
Affected products (4)
ProductVersionsFixed in
openstack/ironic≥ 4.3.0, < 26.1.626.1.6
openstack/ironic≥ 27.0.0, < 29.0.529.0.5
openstack/ironic≥ 30.0.0, < 32.0.132.0.1
openstack/ironic≥ 33.0.0, < 35.0.135.0.1
References (4)
https://bugs.launchpad.net/ironic/+bug/2148331 · [email protected]https://security.openstack.org/ossa/OSSA-2026-008.html · [email protected]http://www.openwall.com/lists/oss-security/2026/04/30/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2026/08/19/6 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 APR 04:53Z
    OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface
    cvelistv5