[OSSA-2026-008] ERRATA 2: Ironic Command Injection in IPMI Console Implementations

[Jay Faulkner <jay () jvf cc>]

=======================================================================
OSSA-2026-008: Command Injection in Ironic IPMI Console Implementations
=======================================================================

:Date: April 27, 2026
:CVE: CVE-2026-42510


Affects
~~~~~~~
- Ironic: >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 
<35.0.1


Description
~~~~~~~~~~~
Dmitry Tantsur and Tuomo Tanskanen from the Metal3.io Security Team 
reported a vulnerability in Ironic's IPMI console backends. A project 
manager for the project marked as a ``node.owner`` can inject arbitrary 
commands which a conductor executes on console activation.
No console backends are enabled by default in Ironic. Only installations 
which have set ``[conductor]/enabled_console_interfaces`` to enable 
either ``ipmitool-shellinabox`` or ``ipmitool-socat`` are vulnerable.



Errata
~~~~~~
- **Errata 1:** When the original advisory was published a CVE number was
  not assigned. CVE-2026-42510 was assigned on 2026-04-29.

- **Errata 2:** The original fix shell-quoted the console command, but
  socat executes it directly without a shell and so treated the quoted
  command line as a single program name. Deployments using the
  ipmitool-socat console interface lose console functionality entirely as
  a result, though the vulnerability itself is not reintroduced. The
  Errata 2 patches provide an additional fix which escapes the command
  for socat's own address syntax.



Patches
~~~~~~~
- **Original** https://review.opendev.org/c/openstack/ironic/+/986418 
(2023.1/antelope (unmaintained))
- **Errata 2** https://review.opendev.org/c/openstack/ironic/+/1000990 
(2023.1/antelope (unmaintained))
- **Original** https://review.opendev.org/c/openstack/ironic/+/986417 
(2024.1/caracal (unmaintained))
- **Errata 2** https://review.opendev.org/c/openstack/ironic/+/1000989 
(2024.1/caracal (unmaintained))
- **Original** https://review.opendev.org/c/openstack/ironic/+/986363 
(2024.2/dalmatian)
- **Original** https://review.opendev.org/c/openstack/ironic/+/986362 
(2025.1/epoxy)
- **Errata 2** https://review.opendev.org/c/openstack/ironic/+/1000986 
(2025.1/epoxy)
- **Original** https://review.opendev.org/c/openstack/ironic/+/986361 
(2025.2/flamingo)
- **Errata 2** https://review.opendev.org/c/openstack/ironic/+/1000985 
(2025.2/flamingo)
- **Original** https://review.opendev.org/c/openstack/ironic/+/986235 
(2026.1/gazpacho)
- **Errata 2** https://review.opendev.org/c/openstack/ironic/+/1000984 
(2026.1/gazpacho)
- **Errata 2** https://review.opendev.org/c/openstack/ironic/+/999701 
(2026.2/hibiscus)


Credits
~~~~~~~
- Dmitry Tantsur from Metal3.io Security Team
- Tuomo Tanskanen from Metal3.io Security Team


References
~~~~~~~~~~
- https://launchpad.net/bugs/2148331
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42510


Notes
~~~~~
- A CVE request was filed with MITRE on 2026-04-27.
- Patches for unmaintained branches are provided as a courtesy.
- The ``ipmitool-shellinabox`` console interface is already scheduled
  for removal from Ironic for lack of security support for shellinabox.
  Security sensitive operators are strongly encouraged to stop use of
  this console interface immediately.
- **Errata 2** The console regression affects the 26.1.6, 29.0.5,
  29.0.6, 32.0.1, 35.0.1, 36.0.0, 37.0.0 and 38.0.0 releases;
  stable/2024.2 has since been retired, so 26.1.6 can only be corrected
  by applying the additional fix locally.


OSSA History
~~~~~~~~~~~~
- 2026-08-19 - Errata 2
- 2026-04-29 - Errata 1
- 2026-04-27 - Original Version

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature