CVE-2026-44917 Details

A vulnerability in OpenStack Ironic versions prior to 35.0.2 allows authenticated project admins or managers to read local files on the Ironic conductor. This is achieved by exploiting the pxe_template feature, which can be manipulated to reference sensitive files such as the Ironic configuration file. The vulnerability arises from inadequate validation of file paths in the pxe_template, leading to arbitrary file reads on the conductor host.

The vulnerable pxe_template feature has been disabled in Ironic versions 35.0.2 and later. For users on unmaintained Ironic versions, the feature can be manually disabled by removing any references to 'pxe_template' in the node.driver_info.