Skip to content
Fencer Intel
high 7.7

CVE-2026-42997 json

OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

published 6mo ago modified last mo. also GHSA-54w4-233h-x86g , PYSEC-2026-2526 , EUVD-2026-27428

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.

Patch / fix

  • pypi ironic-python-agent 26.1.6, 29.0.5, 32.0.1, 35.0.1
  • OpenStack Ironic 26.1.6, 29.0.5, 32.0.1, 35.0.1
  • ironic Debian 12 1:21.1.0-3+deb12u1
  • ironic Debian 13 1:29.0.5-0+deb13u1
  • ironic Debian 14 1:35.0.1-1

debian advisories DEBIAN-CVE-2026-42997

  • openstack-ironic openstack 18.0 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
  • openstack-ironic-api openstack 18.0 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
  • openstack-ironic-common openstack 18.0 1:21.4.5-18.0.20260616204937.9213ccd.el9ost
  • openstack-ironic-conductor openstack 18.0 1:21.4.5-18.0.20260616204937.9213ccd.el9ost

red hat advisories RHSA-2026:39811

Is CVE-2026-42997 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42997 updated cvss 7.7

OpenStack Ironic: OpenStack Ironic: Information disclosure via credential forwarding during mold import

  • Red Hat OpenShift Container Platform 4 openstack-ironic, openstack-ironic-api, python3-ironic-tests, openstack-ironic-common, openstack-ironic-conductor Red Hat OpenStack Platform 17.1 openstack-ironic, openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor
    affected: no fix available
  • Red Hat OpenStack Services on OpenShift 18.0 openstack-ironic 21.4.5-18.0.20260616204937.9213ccd.el9ost, openstack-ironic-api 21.4.5-18.0.20260616204937.9213ccd.el9ost, openstack-ironic-common 21.4.5-18.0.20260616204937.9213ccd.el9ost, openstack-ironic-conductor 21.4.5-18.0.20260616204937.9213ccd.el9ost
    fixed: vendor fix RHSA-2026:39811
  • Red Hat OpenStack Platform 16.2 openstack-ironic, openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CISA ADP 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
OSV 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
GitHub 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi ironic-python-agent
>=33.0.0, <35.0.1
>=30.0.0, <32.0.1
>=27.0.0, <29.0.5
<26.1.6
35.0.1
32.0.1
29.0.5
26.1.6

Affected products

  • OpenStack Ironic
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres
  • CWE-201 Insertion of Sensitive Information Into Sent Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.