Medium severity4.9NVD Advisory· Published Jun 4, 2026· Updated Jun 4, 2026

CVE-2026-44917

Description

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenStack/Ironicinferred3 versions
<35.0.2+ 2 more
- (no CPE)range: <35.0.2
- cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*range: >=17.0.0,<26.1.7
- (no CPE)range: <35.0.2

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/06/03/13nvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2026/06/03/13nvdMailing ListThird Party Advisory
bugs.launchpad.net/ironic/+bug/2148319nvdIssue Tracking

News mentions

OpenStack: Critical RCE and Multiple Ironic Flaws Disclosed Together
Vypr Intelligence · Jun 4, 2026

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000