=====================================================================================
OSSA-2026-012: Remote Code Execution in Ironic conductor when Anaconda
driver enabled
=====================================================================================
:Date: May 11, 2026
:CVE: CVE-2026-44916
Affects
~~~~~~~
- Ironic: >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0
<35.0.2
Description
~~~~~~~~~~~
Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software
Technology) from the Metal3.io Security Team reported a vulnerability in
Ironic's anaconda deploy interface. Users who can set
``node.instance_info['ks_template']`` can achieve remove code execution
on the ironic-conductor process, as the template is rendered without
sandboxing.
In the default configuration, Ironic is not vulnerable to this issue.
However, operators who have enabled the anaconda deploy interface by
adding it to ``[conductor]/enabled_deploy_interfaces`` and have
untrusted users with access to modify ``node.instance_info`` are at risk.
Patches
~~~~~~~
- https://review.opendev.org/c/openstack/ironic/+/987778
(2023.1/antelope (unmaintained))
- https://review.opendev.org/c/openstack/ironic/+/987777 (2024.1/caracal
(unmaintained))
- https://review.opendev.org/c/openstack/ironic/+/987776 (2025.1/epoxy)
- https://review.opendev.org/c/openstack/ironic/+/987775 (2025.2/flamingo)
- https://review.opendev.org/c/openstack/ironic/+/987774 (2026.1/gazpacho)
- https://review.opendev.org/c/openstack/ironic/+/987922 (Bugfix/31.0)
- https://review.opendev.org/c/openstack/ironic/+/987921 (Bugfix/33.0)
- https://review.opendev.org/c/openstack/ironic/+/987920 (Bugfix/34.0)
Credits
~~~~~~~
- Dmitry Tantsur from Red Hat
- Tuomo Tanskanen from Ericsson Software Technology
References
~~~~~~~~~~
- https://bugs.launchpad.net/ironic/+bug/2148307
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44916
Notes
~~~~~
- Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained.
Patches are provided as a courtesy. Releases 2023.2 (bobcat) and
2024.2 (dalmation) are end of life and have not had patches provided.
See https://releases.openstack.org for more information on supported
releases.
- Ironic bugfix branch patches will be available in git for interested
operators. We will not perform an additional release from these
branches.
