CVE-2026-44917

@@ -209,6 +209,13 @@
                    '$pybasedir', 'drivers/modules/initial_grub_cfg.template'),
                help=_('On ironic-conductor node, the path to the initial grub'
                       'configuration template for grub network boot.')),
+    cfg.BoolOpt('enable_insecure_template_override',
+                default=False,
+                help=_('If node level pxe_template override is permitted to '
+                       'be used in this Ironic deployment. This is an '
+                       'insecure pattern filed under CVE-2026-44917 and '
+                       'the feature this guards this is expected to be '
+                       'removed in Ironic release 2027.2.')),
 ]
 
 

@@ -460,9 +460,22 @@ def get_ipxe_config_template(node):
     # loaders by architecture as they are all consistent. Where as PXE
     # could need to be grub for one arch, PXELINUX for another.
     configured_template = CONF.pxe.ipxe_config_template
-    override_template = node.driver_info.get('pxe_template')
-    if override_template:
-        configured_template = override_template
+    insecure_override_template = node.driver_info.get('pxe_template')
+    if CONF.pxe.enable_insecure_template_override:
+        # TODO(TheJulia): Remove the node level pxe_template setting in
+        # a future release as it is inhernetly insecure.
+        if insecure_override_template:
+            configured_template = insecure_override_template
+    elif insecure_override_template:
+        raise exception.InvalidParameterValue(_(
+            'The node\'s driver_info field pxe_template override value is '
+            'insecure (CVE-2026-44917) and should not be used. The '
+            'appropriate approach is to utilize [pxe]ipxe_template_by_arch '
+            'configuration in ironic.conf to match the baremetal node\'s '
+            'architecture. Please work with your Ironic operator to remedy '
+            'your usage and configuration. Default templates may be '
+            'leveraged by deleting the pxe_template value in the driver_info '
+            'field.'))
     return configured_template or get_pxe_config_template(node)
 
 
@@ -477,7 +490,22 @@ def get_pxe_config_template(node):
     :param node: A single Node.
     :returns: The PXE config template file name.
     """
-    config_template = node.driver_info.get("pxe_template", None)
+    config_template = None
+    insecure_override_template = node.driver_info.get("pxe_template", None)
+    if CONF.pxe.enable_insecure_template_override:
+        # TODO(TheJulia): Remove the node level pxe_template setting in
+        # a future release as it is inhernetly insecure.
+        config_template = insecure_override_template
+    elif insecure_override_template:
+        raise exception.InvalidParameterValue(_(
+            'The node\'s driver_info field pxe_template override value is '
+            'insecure (CVE-2026-44917) and should not be used. The '
+            'appropriate approach is to utilize [pxe]pxe_template_by_arch '
+            'configuration in ironic.conf to match the baremetal node\'s '
+            'architecture. Please work with your Ironic operator to remedy '
+            'your usage and configuration. Default templates may be '
+            'leveraged by deleting the pxe_template value in the driver_info '
+            'field.'))
     if config_template is None:
         cpu_arch = node.properties.get('cpu_arch')
         config_template = CONF.pxe.pxe_config_template_by_arch.get(cpu_arch)

@@ -425,13 +425,25 @@ def test_get_pxe_config_template_emtpy_property_bios(self):
         self.assertEqual('bios-template', result)
 
     def test_get_pxe_config_template_per_node(self):
+        cfg.CONF.set_override('enable_insecure_template_override', True,
+                              group='pxe')
         node = obj_utils.create_test_node(
             self.context, driver='fake-hardware',
             driver_info={"pxe_template": "fake-template"},
         )
         result = utils.get_pxe_config_template(node)
         self.assertEqual('fake-template', result)
 
+    def test_get_pxe_config_template_per_node_disabled(self):
+        self.assertFalse(cfg.CONF.pxe.enable_insecure_template_override)
+        node = obj_utils.create_test_node(
+            self.context, driver='fake-hardware',
+            driver_info={"pxe_template": "fake-template"},
+        )
+        self.assertRaisesRegex(
+            exception.InvalidParameterValue, 'CVE-2026-44917',
+            utils.get_pxe_config_template, node)
+
     def test_get_ipxe_config_template(self):
         node = obj_utils.create_test_node(
             self.context, driver='fake-hardware')
@@ -458,12 +470,23 @@ def test_get_ipxe_config_template_none_bios(self):
                          utils.get_ipxe_config_template(node))
 
     def test_get_ipxe_config_template_override_pxe_fallback(self):
+        cfg.CONF.set_override('enable_insecure_template_override', True,
+                              group='pxe')
         node = obj_utils.create_test_node(
             self.context, driver='fake-hardware',
             driver_info={'pxe_template': 'magical'})
         self.assertEqual('magical',
                          utils.get_ipxe_config_template(node))
 
+    def test_get_ipxe_config_template_override_pxe_fallback_disabled(self):
+        self.assertFalse(cfg.CONF.pxe.enable_insecure_template_override)
+        node = obj_utils.create_test_node(
+            self.context, driver='fake-hardware',
+            driver_info={'pxe_template': 'magical'})
+        self.assertRaisesRegex(
+            exception.InvalidParameterValue, 'CVE-2026-44917',
+            utils.get_ipxe_config_template, node)
+
 
 @mock.patch('time.sleep', lambda sec: None)
 class OtherFunctionTestCase(db_base.DbTestCase):

@@ -0,0 +1,28 @@
+---
+security:
+  - |
+    A vulnerability was discovered in an minimally documented feature of
+    Ironic where an absolute path to a ``pxe_template`` override value could
+    be defined by an authenticated and privilged API user. The Ironic team has
+    chosen to immediately deprecate and remove this functionality. To provide
+    an immediate security fix, this functionality is now disabled by default.
+    The functionality can be re-enabled via the
+    ``[pxe]enable_insecure_template_override`` configuration option which
+    was added to ironic.conf with a default value of ``False``.
+    This issue is tracked as
+    `bug 2148319 <https://bugs.launchpad.net/ironic/+bug/2148319>`_.
+fixes:
+  - |
+    Fixes a vulnerability (CVE-2026-44917) which was identified inhandling
+    of pxe_template overrides where an authenticated and authorized user
+    could request an override template via direct file path which would
+    bypass file URL handling guards introduced in OSSA-2025-001. This
+    feature was minimally documented through only a release note, and
+    does not appear to have actual use. This functionality is being
+    disabled by default, and will be promptly removed from Ironic's
+    current development branch.
+deprecations:
+  - |
+    The node ``driver_info`` field value ``pxe_template`` has been
+    deprecated and is expected to be removed in the future Ironic
+    2027.2 release.