CVE-2026-46447: OpenStack Ironic iPXE Boot Script Injection Vulnerability

Technical summary

CVE-2026-46447 is a boot script injection vulnerability in OpenStack Ironic that arises from insufficient validation of iPXE script sources when node.driver_info or node.instance_info fields are modified. The vulnerability is classified under CWE-669 (Incorrect Resource Transfer Between Spheres), indicating a flaw in how untrusted data transitions between security boundaries. The CVSS v3.1 score of 5.8 (MEDIUM severity) reflects a network-accessible attack vector with high attack complexity and high privilege requirements, but significant impact on system integrity and potential scope expansion across the cloud infrastructure. The issue does not require user interaction and affects the confidentiality of system configuration, though direct confidentiality loss is not indicated in the vector.

Business impact

For organizations operating OpenStack Ironic infrastructure, this vulnerability creates a risk of unauthorized boot process manipulation. A compromised administrative account or insider threat could inject malicious boot configurations that persist across node redeployment cycles, potentially leading to rootkit installation, persistent backdoors, or unauthorized system hardening modifications before the OS fully initializes. In multi-tenant or managed service environments, this could enable lateral movement or privilege escalation. The remediation requires a patched Ironic version, during which operators must balance the security urgency against any operational disruptions related to control plane updates.

Affected systems

OpenStack Ironic deployments running versions prior to 35.0.2 are affected. This includes both standalone Ironic deployments and Ironic components within broader OpenStack clouds. The vulnerability requires that an attacker have permissions to modify node configuration objects—typically reserved for cloud administrators, operators, or service accounts with baremetal provisioning authority. Environments with strict role-based access control (RBAC) may have reduced exposure if administrative credentials are well-protected.

Exploitability

The CVSS vector indicates high attack complexity and high privilege requirements, placing this outside the easy-to-exploit category. An attacker must first obtain administrative or operator credentials with the ability to modify node objects in Ironic. However, once that threshold is crossed, the actual injection of the iPXE script is straightforward—it requires only updating a node field with a malicious script URL or inline payload. The attack does not require user interaction on the victim's part; the injected script executes automatically during the next boot cycle. This makes it attractive to insider threats or attackers who have compromised a service account. No active exploitation in the wild has been reported (KEV status: not included).

Remediation

Upgrade OpenStack Ironic to version 35.0.2 or later. Organizations should verify the patch version against the official OpenStack Ironic release notes and security advisories. Additionally, review and audit access controls for administrative credentials that can modify node driver_info and instance_info fields; restrict these permissions to the minimum necessary roles and implement credential rotation policies. Monitor Ironic API logs for suspicious node configuration modifications, particularly changes to boot-related parameters.

Patch guidance

Apply OpenStack Ironic 35.0.2 or a later patch release. Verify against the vendor advisory and release notes to confirm the patch is included. Organizations should test the upgrade in a non-production environment first to ensure compatibility with their current Ironic configuration, particularly if custom drivers or plugins are in use. Plan the upgrade during a maintenance window, as it may require a brief control plane restart. After patching, perform a spot check on a test node to confirm normal boot behavior and PXE provisioning workflows.

Detection guidance

Monitor Ironic API audit logs for modifications to node.driver_info and node.instance_info fields, especially changes to boot_option, boot_mode, or ipxe_bootloader parameters. Look for unusual or unexpected changes initiated by service accounts or administrative users. Implement integrity checks on boot configuration files and iPXE script repositories. Alert on any unauthorized or out-of-policy iPXE script URLs being set in node configurations. If available, use OpenStack Audit (Cadf) logging to correlate API changes with specific user accounts and timestamps.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The MEDIUM CVSS score combined with high privilege requirements places it below critical vulnerabilities, but the integrity impact (rating H in the vector) and potential for scope expansion justify priority over lower-severity issues. Organizations should prioritize patching within their standard maintenance cycles—typically 30 to 90 days—balancing against more critical vulnerabilities that require immediate response. For environments with strong separation of duties and credential hygiene, the risk is somewhat lower; for environments with lax administrative access controls, prioritize this higher.

Risk score, explained

The CVSS v3.1 score of 5.8 reflects: Network-accessible attack vector (AV:N) indicating remote exploitability; High attack complexity (AC:H) because the attacker must first obtain administrative credentials; High privilege requirements (PR:H) requiring operator or admin role; No user interaction required (UI:N); Changed scope (S:C) because a compromised node can potentially affect other systems or services in the environment; No direct confidentiality impact (C:N); High integrity impact (I:H) due to unauthorized boot script injection; and No availability impact (A:N). The cumulative effect is a moderate-severity finding that requires administrative compromise but has meaningful integrity and scope implications.

Frequently asked questions