3
CVE-2026-44916
- EPSS 0.01%
- Veröffentlicht 08.05.2026 06:38:37
- Zuletzt bearbeitet 12.05.2026 00:17:03
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerOpenStack
≫
Produkt
Ironic
Default Statusunaffected
Version
17.0.0
Version <
26.1.7
Status
affected
Version
27.0.0
Version <
29.0.6
Status
affected
Version
30.0.0
Version <
32.0.2
Status
affected
Version
33.0.0
Version <
35.0.2
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.01% | 0.014 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cve@mitre.org | 3 | 1.3 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
|
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.