CVE-2026-42510

Executive Summary

CVE-2026-42510 is a command injection vulnerability in OpenStack Ironic, the bare-metal provisioning service, affecting versions prior to 35.0.1. The flaw allows an authenticated user with access to the Ironic API to execute the ipmitool command with elevated privileges in a non-default configuration where a console interface is enabled. Successful exploitation results in arbitrary command execution on the Ironic conductor node, potentially leading to full compromise of the bare-metal provisioning infrastructure and all managed nodes. The vulnerability is rated Medium severity with a CVSS score of 6.6, and no public exploits or CISA KEV listings have been identified at this time.

Technical Analysis

The vulnerability resides in the console interface handling component of OpenStack Ironic. When a node is configured with a console interface (a non-default configuration typically used for serial-over-LAN access to bare-metal nodes), Ironic delegates console operations to the ipmitool binary to establish IPMI Serial-over-LAN (SOL) sessions.

The core flaw is an improper sanitization of user-controlled node metadata passed to the ipmitool command. Specifically, the console_cmd or related parameter—derived from the node's console_info configuration—is constructed using string concatenation without adequate escaping or validation of shell metacharacters. An attacker who can update node configuration through the Ironic API (via the node.update endpoint with appropriate role permissions) can inject shell commands into the parameters that are appended to the ipmitool invocation.

The vulnerability class is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), indicating that the affected code incorporates functionality from an untrusted source without proper verification. In this case, user-supplied data flows into a system command without being vetted, enabling command injection.

The attack surface is the Ironic API, specifically the PUT /v1/nodes/{node_id} endpoint (node update operation). The non-default console interface must be enabled, which requires the operator to have set console_enabled=true on the node and configured an appropriate console_interface (typically ipmitool-socat or similar). This configuration is common in larger deployments where remote serial console access to provisioned nodes is a standard operational requirement.

The code path involves the ironic-conductor service, which processes the node's console_info dictionary and constructs an ipmitool command line. The injection point is the ipmitool invocation where attacker-controlled fields such as ipmi_username, ipmi_password, ipmi_address, or ipmi_terminal_port are incorporated into the command string without proper shell escaping. On the conductor node, this command is executed via a subprocess call, inheriting the conductor's service account privileges.

Exploitation Scenarios

Reconnaissance: An attacker with valid credentials for the OpenStack environment (tenant user with baremetal:node:update permission, or a compromised operator account) first enumerates nodes to identify those with console functionality enabled. This is accomplished through the Ironic API: GET /v1/nodes?detail=true and inspecting responses for nodes with console_enabled: true.

Weaponization & Trigger: The attacker crafts a node update request that modifies the console_info field, injecting shell metacharacters into the ipmi_username parameter:

curl -X PUT -H "X-Auth-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"node_id": "target-node-uuid", 
       "console_info": {
         "ipmi_username": "admin; id; whoami > /tmp/pwned; #",
         "ipmi_address": "192.168.1.100",
         "ipmi_terminal_port": "7100"
       }}' \
  http://controller:6385/v1/nodes/target-node-uuid

Payload Execution: The attacker then calls PUT /v1/nodes/{node_id}/states with the target state set to console or triggers console access via POST /v1/nodes/{node_id}/console with {"enabled": true}. The ironic-conductor service processes this request, constructs the command string by concatenating the injected values, and executes:

ipmitool -I lanplus -H 192.168.1.100 -U admin; id; whoami > /tmp/pwned; # -P password sol activate

The shell interprets the semicolons, executing id and whoami > /tmp/pwned before the # comments out the remainder. Output redirection allows the attacker to write files on the conductor host.

Post-Exploitation: Once command execution is achieved on the ironic-conductor node, the attacker has access to:

• The conductor's keystone service credentials (/etc/ironic/ironic.conf), enabling lateral movement to the OpenStack control plane.
• The SQL database containing node credentials and PXE boot images.
• The ability to provision malicious images to all managed bare-metal nodes.
• Access to the PXE/TFTP directories to implant backdoored boot images.
• Potential pivot to the undercloud/overcloud infrastructure in TripleO deployments.

Impact Assessment

The business impact of CVE-2026-42510 is significant despite the Medium severity rating. The ironic-conductor service typically runs with root or a dedicated service account with broad system privileges, and it manages the entire bare-metal fleet. A successful exploit leads to:

• Confidentiality breach: Conductor nodes hold credentials for all managed nodes (IPMI passwords, BMC credentials, PXE configuration), plus keystone service tokens. The attacker can extract these and access the entire OpenStack deployment.
• Integrity compromise: An attacker can modify node configuration, inject malicious iSCSI targets, replace deployment images, or alter the conductor codebase—potentially causing persistent backdoor access to all provisioned hardware.
• Availability disruption: The attacker can power-cycle nodes, mark nodes as failed, or interfere with the provisioning pipeline, creating a denial of service across an entire bare-metal environment.

The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that while network access is possible and the confidentiality/integrity/availability impact is High, the attack requires high privileges (authenticated API user with node update rights) and a high attack complexity (non-default configuration must be present). The blast radius is the entire bare-metal infrastructure managed by the affected Ironic deployment—which in many enterprises is the production compute, storage, and database clusters.

The EPSS score of 0.00548 (42.8th percentile) indicates a low current exploitation probability, but the specificity of the target (OpenStack Ironic deployments) and the high value of bare-metal infrastructure suggest dedicated attackers may still target this vector. No known threat actor campaigns have been publicly documented as of this report.

Detection Guidance

Sigma Rule

title: OpenStack Ironic Command Injection via Console Interface
id: 7f8f3c12-abc4-4d5e-9f01-2b3c4d5e6f70
status: experimental
description: Detects suspicious node update requests to OpenStack Ironic API containing shell metacharacters in console_info parameters
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1190
    - attack.execution
    - cve.2026-42510
logsource:
    category: application
    product: openstack
    service: ironic-api
detection:
    selection:
        event.action: "node.update"
        request.body.console_info.ipmi_username|contains: 
            - ';'
            - '|'
            - '&&'
            - '||'
            - '`'
            - '$('
            - '>>'
            - '> /tmp/'
            - '>& /dev/'
    condition: selection
fields:
    - source.ip
    - user.name
    - request.body.node_id
    - request.body.console_info
level: high
falsepositives:
    - Legitimate usernames containing special characters are rare but possible
    - Automated management scripts may pass special characters in passwords

YARA Rule

rule OpenStack_Ironic_CVE_2026_42510_Command_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect OpenStack Ironic console_info command injection attempts"
        cve = "CVE-2026-42510"
        date = "2026-01-15"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-42510"

    strings:
        $api_call = "PUT" ascii wide
        $console_path = "/v1/nodes/" ascii wide
        $console_info = "console_info" ascii wide nocase
        $ipmi_user = "ipmi_username" ascii wide nocase
        $ipmi_pass = "ipmi_password" ascii wide nocase
        $shell_semi = "; " ascii wide
        $shell_pipe = "| " ascii wide
        $shell_amp = "&&" ascii wide
        $shell_or = "||" ascii wide
        $shell_backtick = "`" ascii wide
        $shell_dollar = "$(" ascii wide
        $redirect = ">" ascii wide
        $special_cmd = ("id" or "whoami" or "cat" or "wget" or "curl" or "/bin/sh" or "/bin/bash") ascii wide nocase

    condition:
        uint16(0) == 0x5B7B and
        $console_info and
        $ipmi_user and
        any of ($shell_*) and
        $redirect and
        $special_cmd and
        filesize < 100KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-42510 OpenStack Ironic Console Command Injection"; 
sid:202642510; rev:1; 
metadata:attack_target OpenStack, created_at 2026_01_15, deployment Perimeter, 
signature_severity Major, tag cve-2026-42510, 
performance_impact Low; 
flow:to_server, established; 
http.method; content:"PUT"; http_uri; content:"/v1/nodes/"; 
http.request_body; content:"console_info"; nocase; 
http.request_body; content:"ipmi_username"; nocase; 
pcre:"/ipmi_(username|password)\\\s*[:=]\\\s*[^,}]{0,200}(;|&&|\|\||`|\$\()/iR"; 
classtype:attempted-admin; 
reference:cve,2026-42510;)

Elastic Detection

sequence by source.ip, user.name with maxspan=10m
  [iam where event.action == "node.update" and 
   process.name == "ironic-api" and
   http.request.body.text : "console_info" and
   http.request.body.text : "*ipmi_username*"]
  [process where event.action == "exec" and 
   process.name == "sh" and
   process.parent.name == "ironic-conductor" and
   process.args : ("*;*", "*|*", "*&&*", "*`*", "*$(*")]

Splunk SPL Query

index=main sourcetype="openstack:ironic:api" 
| where action="node.update" 
| spath input=req_body 
| search req_body{console_info}="*" AND (req_body{console_info}{ipmi_username}="*;*" OR req_body{console_info}{ipmi_username}="*|*" OR req_body{console_info}{ipmi_username}="*&&*" OR req_body{console_info}{ipmi_username}="*`*" OR req_body{console_info}{ipmi_username}="*$(*")
| eval suspicious=true 
| table _time, src_ip, user_name, node_id, req_body{console_info}{ipmi_username}, req_body{console_info}{ipmi_password}
| sort -_time
| rename src_ip as "Source IP", user_name as "OpenStack User", node_id as "Target Node"

Wazuh OSSEC Rule

<group name="openstack">
  <rule id="425110" level="12">
    <decoded>
      <program_name>ironic-api</program_name>
    </decoded>
    <field name="action">node.update</field>
    <regex>console_info.*ipmi_username.*(;|\||&amp;&amp;|`|\$\()</regex>
    <description>CVE-2026-42510: Command injection attempt in OpenStack Ironic console_info</description>
    <group>attack.t1190,execution</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="425111" level="10">
    <decoded>
      <program_name>ironic-conductor</program_name>
    </decoded>
    <field name="command">.\bipmitool\b.*</field>
    <regex>(;|\||&amp;&amp;|`|\$\()</regex>
    <description>CVE-2026-42510: Suspicious ipmitool execution on ironic-conductor</description>
    <group>attack.t1190,execution</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 3/4 (LIKELY), with two independent sources (OSV and Debian) confirming the fix.

1) Immediate Mitigations (before patching):

• Disable the console interface on all Ironic nodes: openstack baremetal node set $NODE --console-enabled false or via the API.
• Restrict API access to the /v1/nodes/{node_id} update endpoint to only trusted service accounts. Apply keystone RBAC policies to limit baremetal:node:update permissions to dedicated operator roles.
• Place the Ironic API behind a security group/firewall that only allows access from the management network.
• Monitor ironic-conductor logs for unexpected ipmitool invocations containing shell metacharacters.

2) Patch/Upgrade Steps:

• Upgrade OpenStack Ironic to version 35.0.1 or later: pip install ironic==35.0.1 (or the equivalent package manager for your distribution).
• For Debian/Ubuntu systems: apt update && apt install ironic-conductor=35.0.1*.
• For CentOS/RHEL: yum update openstack-ironic-conductor.
• After upgrade, restart the ironic-conductor and ironic-api services: systemctl restart openstack-ironic-conductor openstack-ironic-api.
• Verify the fix by attempting to submit a node update with shell metacharacters in console_info and confirming proper rejection or escaping.

3) Long-Term Hardening:

• Run the ironic-conductor service with limited privileges (dedicated non-root user) and enable SELinux/AppArmor confinement.
• Implement network segmentation: isolate the Ironic management API and conductor nodes from general tenant networks.
• Enable API request validation middleware that rejects requests containing shell metacharacters in string fields.
• Deploy audit logging for all API mutations and configure alerts on node configuration changes.
• Regularly review keystone roles and revoke baremetal:node:update from tenant users unless explicitly required.
• Subscribe to the OpenStack security-announce mailing list for future advisories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-42510
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-42510
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-42510
4. OpenStack Ironic Release Notes (35.0.1): https://docs.openstack.org/releasenotes/ironic/
5. OpenStack Security Advisories: https://security.openstack.org/

As of this writing, no exploit-in-the-wild activity or attribution to known threat actor groups has been publicly reported for CVE-2026-42510. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should still treat this as a high-priority fix given the criticality of bare-metal provisioning infrastructure in enterprise environments.