CVE-2026-48681: OpenStack Ironic Directory Traversal File Overwrite (MEDIUM)

Technical summary

CVE-2026-48681 is a path traversal flaw in OpenStack Ironic versions prior to 35.0.2 that arises from insufficient validation of ISO image contents during deployment. The vulnerability maps to CWE-23 (Relative Path Traversal) and permits an authenticated high-privileged user to supply a malicious ISO with directory traversal sequences in file paths. When Ironic processes this image, it writes files to unintended locations on the host filesystem, bypassing intended access controls. The attack surface is limited by the requirement for high administrative privileges and non-trivial setup, reflected in the CVSS vector's AC:H (attack complexity: high) rating.

Business impact

This vulnerability poses a confidentiality and integrity risk to OpenStack deployments. While exploitation requires high-privilege credentials, a compromised administrator account or insider threat could leverage this to alter system configurations, inject backdoors, or expose sensitive deployment data. For organizations running Ironic in production bare-metal environments, successful exploitation could lead to persistent infrastructure compromise, supply-chain contamination of deployed workloads, or cascading failures across physical assets under Ironic management.

Affected systems

OpenStack Ironic deployments running versions before 35.0.2 are affected. This includes both community and commercial OpenStack distributions that bundle or integrate Ironic for bare-metal provisioning. Version 35.0.2 and later contain the fix. Organizations should verify their exact Ironic version via `ironic-conductor --version` or by checking the release notes in their OpenStack distribution.

Exploitability

Exploitation is moderately difficult in practice. The attacker must possess high-privilege administrator credentials (PR:H in CVSS), and the attack requires manual crafting of a malicious ISO image combined with knowledge of Ironic's deployment workflow. No public exploit code has been reported, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation in the wild at this time. However, the barrier to exploitation is substantially lower for insiders or accounts with admin-level access.

Remediation

Upgrade OpenStack Ironic to version 35.0.2 or later. Organizations should prioritize patching in environments where Ironic manages production bare-metal infrastructure or where non-root administrative accounts exist. In the interim, restrict ISO upload and deployment privileges to a minimal set of trusted operators, implement file integrity monitoring on critical system directories during deployments, and audit Ironic deployment logs for suspicious image sources or file operations.

Patch guidance

Obtain version 35.0.2 or later from the official OpenStack release channels or your distribution maintainer. Test the patch in a non-production environment first to verify compatibility with your Ironic deployment (particularly any custom plugins or integrations). Standard OpenStack upgrade procedures apply: update the Ironic conductor and API services, and verify service health through `openstack baremetal conductor list` and conductor logs. No database migrations are indicated, but consult the OpenStack Ironic 35.0.2 release notes for any additional upgrade steps specific to your configuration.

Detection guidance

Monitor for anomalous file creation or modification in unexpected paths on Ironic compute nodes during ISO deployments. Examine Ironic conductor logs for errors related to file operations with unusual paths containing traversal sequences (../ or similar). Use auditd rules to track file writes to sensitive system directories (/etc, /usr/local/bin, etc.) that occur during bare-metal instance provisioning. Network-based detection is limited; focus on host-level file integrity monitoring and conductor audit logs. Check Ironic API request logs for deployments using ISO images from untrusted or unexpected sources.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score (5.9), prioritize patching because it affects infrastructure-layer services that govern bare-metal deployments. The high-privilege requirement reduces immediate risk for most organizations, but the potential for persistent infrastructure compromise and the centrality of Ironic to bare-metal cloud operations warrant timely remediation. The absence from the KEV catalog indicates it is not currently a mass-exploitation target, providing a window for controlled patching.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects a network-accessible service (AV:N) with high attack complexity (AC:H) requiring high privileges (PR:H), but with high impact on confidentiality and integrity (C:H/I:H/A:N). The score appropriately captures that while the vulnerability is serious, real-world exploitation is constrained by privilege and complexity requirements. Organizations with strict privilege separation and audit controls will see lower practical risk than those with permissive administrator account policies.

Frequently asked questions