CVE-2026-46447: 
OpenStack Ironic vulnerability analysis and mitigation

CVE-2026-46447 is a Boot Script Injection vulnerability in OpenStack Ironic, classified under OSSA-2026-017, that allows a user with access to modify node.driver_info or node.instance_info to inject a crafted value enabling iPXE script execution during the node boot process. It was reported by Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team and disclosed on June 3, 2026. Affected versions include Ironic >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, and >=33.0.0 <35.0.2. The NVD assigns a CVSS v3.1 base score of 7.7 (High), while the GitHub Advisory Database scores it at 5.8 (Moderate) (OSS-Sec Advisory, GitHub Advisory).

The vulnerability is rooted in insufficient input validation within Ironic's kernel command line override code (CWE-669: Incorrect Resource Transfer Between Spheres). An attacker with low-privileged access to the Ironic API — specifically the ability to set or modify node.driver_info or node.instance_info — can craft a malicious value that causes Ironic to generate an iPXE boot script containing attacker-controlled content, which is then executed during the node provisioning process. The attack vector is network-based and requires no user interaction, but does require at least low-level privileges to modify node metadata. Patches are available via OpenDev review (e.g., https://review.opendev.org/c/openstack/ironic/+/991374 for 2026.1/gazpacho), and an errata was issued on June 15, 2026 to correct an issue where initial patches erroneously rejected valid URL-encoded kernel parameters (OSS-Sec Advisory, OSS-Sec Errata).

Successful exploitation allows an attacker to inject and execute arbitrary iPXE scripts during the boot process of provisioned bare-metal nodes, resulting in a high integrity impact with a changed scope — meaning the compromise extends beyond the Ironic service itself to the provisioned systems. There is no direct confidentiality or availability impact per the CVSS scoring, but arbitrary boot-time code execution could enable persistent backdoors, supply chain-style compromise of provisioned infrastructure, or lateral movement within a bare-metal cloud environment. The impact is particularly significant in multi-tenant OpenStack deployments where different users share the Ironic provisioning service (OSS-Sec Advisory, GitHub Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.025%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user with at least low-level privileges to modify node metadata in the Ironic API, which limits the attack surface compared to fully unauthenticated vulnerabilities.

1. Gain API Access: Obtain credentials or a token with at least low-level access to the OpenStack Ironic API, sufficient to modify node.driver_info or node.instance_info on a target node.
2. Craft Malicious Payload: Construct a specially crafted kernel command line override value containing iPXE script directives or special characters that Ironic's parser will interpret as iPXE script content rather than plain kernel parameters.
3. Set Node Metadata: Use the Ironic API (e.g., PATCH /v1/nodes/{node_ident}) to set the malicious value in node.driver_info or node.instance_info on a target bare-metal node.
4. Trigger Node Boot: Initiate or wait for the node to be provisioned or rebooted, causing Ironic to generate an iPXE boot script incorporating the attacker-controlled content.
5. Execute Injected Script: The iPXE firmware on the node fetches and executes the generated boot script, running the attacker's injected commands with elevated privileges during the boot process, potentially establishing persistence or enabling further compromise (OSS-Sec Advisory).

• Logs: Ironic API logs showing unexpected PATCH requests to /v1/nodes/{node_ident} modifying driver_info or instance_info with unusual or encoded special characters; Ironic conductor logs showing anomalous iPXE script generation.
• Network: Bare-metal nodes making unexpected outbound HTTP/HTTPS connections during PXE boot to attacker-controlled servers; unusual TFTP or HTTP traffic from the provisioning network to external IPs.
• Configuration: Node metadata (node.driver_info or node.instance_info) containing special characters such as #, &&, ||, URL-encoded sequences, or iPXE script keywords (e.g., #!ipxe, chain, imgload) in kernel command line override fields.
• Process/Boot: Unexpected or unauthorized OS images or scripts being loaded during node provisioning; nodes booting into unrecognized or modified environments after provisioning.

Operators should upgrade OpenStack Ironic to the following fixed versions: 26.1.7 (for >=17.0.0), 29.0.6 (for >=27.0.0), 32.0.2 (for >=30.0.0), or 35.0.2 (for >=33.0.0). Both the original patches and the errata 1 patches (issued June 15, 2026) must be applied together for correct behavior, as the initial patches could erroneously reject valid URL-encoded kernel parameters. As a temporary workaround, setting CONF.conductor.disable_kernel_parameter_parsing to true restricts Ironic to blocking only the most dangerous special characters, though this provides less comprehensive protection. Additionally, operators should restrict API access to node.driver_info and node.instance_info to trusted users only, and implement network access controls on the Ironic provisioning service (OSS-Sec Advisory, OSS-Sec Errata).

The vulnerability was disclosed via the OpenStack Security Advisory (OSSA-2026-017) and the oss-security mailing list by Jay Faulkner on June 3, 2026, with an errata issued on June 15, 2026 to address issues with the initial patches. Ubuntu issued security notice USN-8421-1 addressing the issue, and Debian also released updates for the ironic package. The vulnerability received coverage on Linux-focused news aggregators and security tracking sites, and was noted on Bluesky by infosec community accounts shortly after disclosure (OSS-Sec Advisory, Ubuntu Advisory).