ZeroDay Findings
Sign inSign up

Findings

CVE-2026-44916

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

Published May 8, 2026 · updated Jun 18, 2026 · openstack ironic

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 8, 2026 · NIST NVD

    Detected

    In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

  2. Jun 18, 2026 · NIST NVD

    Updated

    In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

Affected

  • cpe openstack/ironicversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-44916

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-44916

    In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

    nvd.nist.gov

References