OSSA-2026-008: Command Injection in Ironic IPMI Console Implementations

Date:

April 27, 2026

CVE:

CVE-2026-42510

Affects

• Ironic: >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1

Description

Dmitry Tantsur and Tuomo Tanskanen from the Metal3.io Security Team reported a vulnerability in Ironic’s IPMI console backends. A project manager for the project marked as a node.owner can inject arbitrary commands which a conductor executes on console activation. No console backends are enabled by default in Ironic. Only installations which have set [conductor]/enabled_console_interfaces to enable either ipmitool-shellinabox or ipmitool-socat are vulnerable.

Errata

• Errata 1: When the original advisory was published a CVE number was not assigned. CVE-2026-42510 was assigned on 2026-04-29.

• Errata 2: The original fix shell-quoted the console command, but socat executes it directly without a shell and so treated the quoted command line as a single program name. Deployments using the ipmitool-socat console interface lose console functionality entirely as a result, though the vulnerability itself is not reintroduced. The Errata 2 patches provide an additional fix which escapes the command for socat’s own address syntax.

Patches

• Original https://review.opendev.org/c/openstack/ironic/+/986418 (2023.1/antelope (unmaintained))

• Errata 2 https://review.opendev.org/c/openstack/ironic/+/1000990 (2023.1/antelope (unmaintained))

• Original https://review.opendev.org/c/openstack/ironic/+/986417 (2024.1/caracal (unmaintained))

• Errata 2 https://review.opendev.org/c/openstack/ironic/+/1000989 (2024.1/caracal (unmaintained))

• Original https://review.opendev.org/c/openstack/ironic/+/986363 (2024.2/dalmatian)

• Original https://review.opendev.org/c/openstack/ironic/+/986362 (2025.1/epoxy)

• Errata 2 https://review.opendev.org/c/openstack/ironic/+/1000986 (2025.1/epoxy)

• Original https://review.opendev.org/c/openstack/ironic/+/986361 (2025.2/flamingo)

• Errata 2 https://review.opendev.org/c/openstack/ironic/+/1000985 (2025.2/flamingo)

• Original https://review.opendev.org/c/openstack/ironic/+/986235 (2026.1/gazpacho)

• Errata 2 https://review.opendev.org/c/openstack/ironic/+/1000984 (2026.1/gazpacho)

• Errata 2 https://review.opendev.org/c/openstack/ironic/+/999701 (2026.2/hibiscus)

Credits

• Dmitry Tantsur from Metal3.io Security Team

• Tuomo Tanskanen from Metal3.io Security Team

References

• https://launchpad.net/bugs/2148331

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42510

Notes

• A CVE request was filed with MITRE on 2026-04-27.

• Patches for unmaintained branches are provided as a courtesy.

• The ipmitool-shellinabox console interface is already scheduled for removal from Ironic for lack of security support for shellinabox. Security sensitive operators are strongly encouraged to stop use of this console interface immediately.

• Errata 2 The console regression affects the 26.1.6, 29.0.5, 29.0.6, 32.0.1, 35.0.1, 36.0.0, 37.0.0 and 38.0.0 releases; stable/2024.2 has since been retired, so 26.1.6 can only be corrected by applying the additional fix locally.

OSSA History

• 2026-08-19 - Errata 2

• 2026-04-29 - Errata 1

• 2026-04-27 - Original Version