An issue was discovered in idrac in OpenStack Ironic before 35.0.1.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 5, 2026 · NIST NVD

   Detected

   An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and

2. Jul 24, 2026 · NIST NVD

   Updated

   An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and

Affected

• cpe openstack/ironicversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-42997

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-42997

  An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is

  nvd.nist.gov

References

• Mailing List · openwall.com
• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · bugzilla.redhat.com
• Reference · security.access.redhat.com
• Patch · security.openstack.org
• Mailing List · openwall.com