File Write Vulnerability in OpenStack Ironic by OpenStack

CVE-2025-44021

What is CVE-2025-44021?

OpenStack Ironic, prior to version 29.0.1, contains a vulnerability that allows unintended file writing to target node disks during image handling. When deployments are executed via the API, a malicious actor can provide a file path, potentially leading to the corruption or unauthorized alteration of Node disk data. While exploitation requires certain conditions, such as insecure configurations or disabled automated cleaning, it poses a real threat in environments lacking default security measures. Updated versions (24.1.3, 26.1.1, and 29.0.1) effectively mitigate this risk.

References