CVE-2026-42997 OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
Attackers can obtain sensitive Keystone tokens or basic credentials during import, potentially gaining unauthorized access to OpenStack services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42997?
CVE-2026-42997 is a high-severity vulnerability in OpenStack Ironic, published on 5 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
Which versions are affected by CVE-2026-42997?
9 open source packages ship an affected version, including ironic-python-agent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ironic-python-agent PyPI | All versions | 26.1.6, 29.0.5, 32.0.1, 35.0.1 |
ironic-python-agent PyPI | All versions | 26.1.6 |
ironic-python-agent PyPI | All versions | 26.1.6 |
ironic-python-agent PyPI | From 27.0.0 | 29.0.5 |
ironic-python-agent PyPI | From 27.0.0 | 29.0.5 |
ironic-python-agent PyPI | From 30.0.0 | 32.0.1 |
3 more packages
ironic-python-agent PyPI | From 30.0.0 | 32.0.1 |
ironic-python-agent PyPI | From 33.0.0 | 35.0.1 |
ironic-python-agent PyPI | From 33.0.0 | 35.0.1 |
Linux distribution packages (4)
openstack-ironic Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
openstack-ironic-api Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
openstack-ironic-common Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
openstack-ironic-conductor Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20260616204937.9213ccd.el9ost |
Products include Openstack Ironic.
How do I fix CVE-2026-42997?
Upgrade ironic-python-agent to a fixed version for your release line: 26.1.6, 29.0.5, 32.0.1 or 35.0.1.
Is CVE-2026-42997 being exploited?
There is no known exploitation of CVE-2026-42997 in the wild and no public exploit code.
Other vulnerabilities in OpenStack Ironic
- CVE-2026-42510 OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
- CVE-2015-7514 Information disclosure in n/a
- CVE-2026-48681 OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
- CVE-2026-46447 OpenStack Ironic allows Boot Script Injection
- CVE-2026-50589 OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
Sources
Also known as DEBIAN-CVE-2026-42997, GHSA-54w4-233h-x86g, PYSEC-2026-2526, RHSA-2026:39811, UBUNTU-CVE-2026-42997.