CVE-2026-42510: OpenStack Ironic RCE Vulnerability

CVE-2026-42510 Overview

OpenStack Ironic before version 35.0.1 contains a command injection vulnerability that allows ipmitool execution in non-default configurations utilizing a console interface. This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and enables authenticated attackers with high privileges to potentially execute arbitrary commands through the IPMI console interface mechanism.

Critical Impact

Privileged attackers can exploit the ipmitool execution path in non-default console interface configurations to achieve complete compromise of confidentiality, integrity, and availability on affected OpenStack Ironic deployments.

Affected Products

• OpenStack Ironic versions before 35.0.1
• OpenStack deployments using non-default console interface configurations
• Systems with ipmitool console driver enabled

Discovery Timeline

• 2026-04-28 - CVE CVE-2026-42510 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-42510

Vulnerability Analysis

This vulnerability exists in OpenStack Ironic's handling of ipmitool execution when configured with a non-default console interface. OpenStack Ironic is the bare metal provisioning service for OpenStack cloud deployments, responsible for managing and provisioning physical servers. The flaw relates to CWE-829, indicating that untrusted functionality is being included in a security-sensitive context.

The vulnerability requires network access but has high attack complexity, meaning specific conditions must be met for exploitation. An attacker needs high privileges within the OpenStack environment to exploit this vulnerability, but successful exploitation can result in complete compromise of system confidentiality, integrity, and availability.

Root Cause

The root cause stems from improper handling of the ipmitool execution path when Ironic is configured with a console interface that deviates from the default configuration. The vulnerability allows functionality from an untrusted control sphere to be included in the execution flow, potentially enabling command injection through the IPMI management interface.

The ipmitool utility is used by Ironic to communicate with server baseboard management controllers (BMCs) via the Intelligent Platform Management Interface (IPMI) protocol. When the console interface is enabled in non-default configurations, insufficient input validation or command construction allows attackers to inject malicious commands.

Attack Vector

The attack vector is network-based, targeting OpenStack Ironic deployments where:

1. The console interface is enabled (non-default configuration)
2. The attacker has authenticated access with elevated privileges
3. ipmitool execution paths are accessible

Exploitation requires the attacker to craft malicious input that gets passed to the ipmitool command execution flow, potentially through console interface operations. The high complexity rating indicates that additional conditions beyond attacker control must be present.

The vulnerability mechanism involves improper command construction or insufficient sanitization when invoking ipmitool for console-related operations. Technical details can be found in the Launchpad Bug Report and the OpenWall OSS Security Mailing.

Detection Methods for CVE-2026-42510

Indicators of Compromise

• Unusual ipmitool command executions with unexpected arguments or shell metacharacters
• Anomalous process spawning from Ironic conductor services
• Unexpected outbound network connections from bare metal management systems
• Modified or suspicious entries in Ironic service logs related to console operations

Detection Strategies

• Monitor Ironic conductor logs for unusual console interface operations or command patterns
• Implement process monitoring on OpenStack nodes to detect unexpected ipmitool invocations
• Deploy network detection rules for anomalous IPMI traffic patterns
• Audit OpenStack Ironic configurations for non-default console interface settings

Monitoring Recommendations

• Enable verbose logging for Ironic conductor services to capture detailed ipmitool execution traces
• Implement file integrity monitoring on Ironic configuration files to detect unauthorized changes
• Configure SIEM alerts for process execution anomalies on OpenStack control plane nodes
• Monitor for privilege escalation attempts within OpenStack authentication systems

How to Mitigate CVE-2026-42510

Immediate Actions Required

• Upgrade OpenStack Ironic to version 35.0.1 or later immediately
• Disable non-default console interface configurations if not required for operations
• Review and restrict access to Ironic conductor services to essential personnel only
• Implement network segmentation to isolate IPMI/BMC management traffic

Patch Information

The vulnerability is addressed in OpenStack Ironic version 35.0.1. Administrators should upgrade to this version or later to remediate the vulnerability. Detailed patch information and security advisory details are available through the Launchpad Bug Report.

Workarounds

• Disable the console interface in Ironic configurations if it is not operationally required
• Implement strict network ACLs to limit access to the Ironic API and conductor services
• Use firewall rules to restrict ipmitool traffic to authorized management networks only
• Deploy application-level firewalling to monitor and filter commands sent to BMC interfaces

# Configuration example - Disable console interface in Ironic
# Edit /etc/ironic/ironic.conf

[DEFAULT]
enabled_console_interfaces = no-console

# Restart Ironic conductor service after configuration change
systemctl restart openstack-ironic-conductor