MEDIUM6.6

PYSEC-2026-2525

OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

Quick fix

PYSEC-2026-2525 — ironic: upgrade to the fixed version with the command below.

pip install --upgrade 'ironic>=35.0.1'

Details

OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 0Fixed in: 35.0.1

Fixpip install --upgrade 'ironic>=35.0.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2026-42510[ADVISORY]
https://bugs.launchpad.net/ironic/+bug/2148331[WEB]
https://github.com/openstack/ironic[PACKAGE]
https://security.openstack.org/ossa/OSSA-2026-008.html[WEB]
http://www.openwall.com/lists/oss-security/2026/04/30/1[WEB]
https://pypi.org/project/ironic[PACKAGE]
https://github.com/advisories/GHSA-wqpv-c3pp-3m58[ADVISORY]