Unauthenticated access to Ironic API

CVE-2023-40585

What is CVE-2023-40585?

A vulnerability exists in the OpenStack Ironic API when it is not deployed with TLS and lacks separation of API and Conductor services. In such configurations, the API is not subject to authentication protections, leaving it open to access by anyone if the node is not secured by a firewall. This issue primarily arises in versions prior to capm3-v1.4.3. Although the default installation ensures secure access via TLS and basic authentication, improper configuration can expose the API, making it crucial for operators to adhere to best practices. Workarounds include enforcing TLS for the Ironic API or configuring separate services for API and Conductor, with the use of an httpd front-end to ensure proper authentication.

References