CVE-2026-48681: 
OpenStack Ironic vulnerability analysis and mitigation

CVE-2026-48681 is a relative path traversal vulnerability (OSSA-2026-018) in OpenStack Ironic that allows authenticated users to overwrite arbitrary files on an Ironic conductor's disk or a target deployment disk via a maliciously crafted ISO image. It affects Ironic versions >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, and >=33.0.0 <35.0.2. The vulnerability was reported by Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team and publicly disclosed on June 3, 2026. The NVD assigns a CVSS v3.1 base score of 8.1 (High), while the GitHub Advisory Database rates it 5.9 (Moderate) using a higher-privilege/complexity vector (OSS Security List, GitHub Advisory).

The vulnerability is classified as CWE-23 (Relative Path Traversal), where Ironic's ISO handling code fails to properly neutralize path traversal sequences (e.g., ../) embedded within a crafted ISO image (GitHub Advisory). During deployment, when Ironic processes an ISO image for configdrive, virtual media-based boot interfaces, or the anaconda deploy interface, it does not restrict file extraction paths to a safe directory, allowing files to be written to arbitrary locations on the conductor's filesystem or the target disk (OSS Security List). Exploitation requires the attacker to have access to deploy nodes — specifically the ability to submit deployment requests with ISO images — making this a low-privilege, network-accessible attack under the NVD scoring. Patches are available via OpenDev code review for all supported branches (OSS Security List).

Successful exploitation allows an authenticated attacker to overwrite arbitrary files on the Ironic conductor host or on the target bare-metal node's disk during deployment, resulting in high integrity and confidentiality impact with no availability impact (GitHub Advisory). By overwriting sensitive system files (e.g., SSH authorized keys, sudoers, cron jobs, or service binaries), an attacker could escalate privileges or achieve persistent code execution on the conductor or provisioned nodes (OSS Security List). In cloud environments where Ironic manages bare-metal infrastructure, this could enable lateral movement across provisioned nodes or compromise the integrity of the entire deployment pipeline.

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.13–0.15%, placing it in the 36th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with node deployment privileges, which limits the attacker pool but does not eliminate risk in multi-tenant OpenStack environments.

1. Gain authenticated access: Obtain credentials for an OpenStack account with sufficient privileges to deploy bare-metal nodes via Ironic (e.g., a tenant user with access to configdrive, virtual media boot, or the anaconda deploy interface).
2. Craft a malicious ISO image: Create an ISO image containing files with path traversal sequences in their embedded filenames (e.g., ../../etc/cron.d/backdoor or ../../root/.ssh/authorized_keys), embedding a malicious payload (e.g., a reverse shell script or attacker-controlled SSH key).
3. Submit deployment request: Use the OpenStack API or CLI to initiate a node deployment, supplying the crafted ISO image as the configdrive source or virtual media image.
4. Trigger file overwrite: When Ironic's conductor processes the ISO during deployment, it extracts files without sanitizing path traversal sequences, writing the attacker-controlled content to the targeted path on the conductor's filesystem or the target node's disk.
5. Achieve code execution or persistence: Depending on the overwritten file, the attacker gains persistent access (e.g., via SSH key injection) or code execution (e.g., via cron job or service binary replacement) on the conductor host or provisioned bare-metal node (OSS Security List).

• File System: Unexpected or modified files in sensitive directories (e.g., /etc/cron.d/, /root/.ssh/authorized_keys, /etc/sudoers.d/, system binary paths) with timestamps correlating to Ironic deployment activity; new or altered files outside the expected Ironic working directory.
• Logs: Ironic conductor logs (/var/log/ironic/ironic-conductor.log) showing ISO extraction operations with unusual file paths containing .. sequences; deployment logs referencing unexpected file destinations.
• Network: Unexpected outbound connections from the Ironic conductor host to unknown external IPs following a deployment event, potentially indicating a reverse shell or C2 beacon.
• Process: Unusual processes spawned by the Ironic conductor service (e.g., shell interpreters, network tools like curl, wget, nc) shortly after a deployment operation completes.

Operators should upgrade OpenStack Ironic to the following patched versions: 26.1.7 or later (for the 17.0.0–26.1.x branch), 29.0.6 or later (for 27.0.0–29.0.x), 32.0.2 or later (for 30.0.0–32.0.x), or 35.0.2 or later (for 33.0.0+) (OSS Security List). Patches for unmaintained releases (2023.1/antelope, 2024.1/caracal) are provided as a courtesy via OpenDev; releases 2023.2/bobcat and 2024.2/dalmation are end-of-life with no patches available. As interim mitigations, restrict who can submit deployment requests with ISO images, implement file integrity monitoring on critical conductor filesystem paths, and validate/sanitize ISO image inputs to detect traversal sequences before processing.

The vulnerability was disclosed via the OpenStack Security Advisory (OSSA-2026-018) posted to the oss-security mailing list by Jay Faulkner on June 3, 2026, crediting the Metal3.io Security Team for responsible disclosure (OSS Security List). Ubuntu issued security notice USN-8421-1 addressing the issue, and Debian also released updates for affected packages. Coverage appeared across Linux-focused news outlets and security aggregators shortly after disclosure, with no notable controversy or significant social media amplification observed.