{"id":"CVE-2026-42510","aliases":["GHSA-wqpv-c3pp-3m58","PYSEC-2026-2525"],"title":"OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere","summary":"OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","vendor":"ironic","product":"ironic","ecosystem":"pip","affected":["ironic < 35.0.1"],"patched":["ironic 35.0.1"],"published":"2026-04-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:03.838123142Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wqpv-c3pp-3m58","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42510"},{"url":"https://bugs.launchpad.net/ironic/+bug/2148331"},{"url":"https://github.com/openstack/ironic"},{"url":"https://security.openstack.org/ossa/OSSA-2026-008.html"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/30/1"}],"tags":["osv","pip"],"epss":0.00567,"epssPercentile":0.45806,"ingestedAt":"2026-07-08T18:25:53.888Z","slug":"CVE-2026-42510","body":"## Overview\n\nOpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.\n\n## Affected packages\n\n- `ironic < 35.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ironic 35.0.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}