CVE-2026-42510

State: Published
Severity: 6.6 Medium
Published: Apr 28, 2026
Updated: Aug 20, 2026
Reserved: Apr 28, 2026

Description

OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	mitre

Weaknesses

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

Product	Versions
IronicOpenStack	4.3.0 to before 26.1.6Affected 27.0.0 to before 29.0.5Affected 30.0.0 to before 32.0.1Affected 33.0.0 to before 35.0.1Affected

References

https://bugs.launchpad.net/ironic/+bug/2148331
https://security.openstack.org/ossa/OSSA-2026-008.html
http://www.openwall.com/lists/oss-security/2026/04/30/1
http://www.openwall.com/lists/oss-security/2026/08/19/6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.