CVE-2026-44916 LOW

CVE-2026-44916

Vendor Openstack
Product Ironic
Weakness CWE-1336
Published May 8, 2026
Last update May 20, 2026
View on NVD All CVEs

CVSS base score

3.0/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-6984 AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine CVE-2024-4040 Unauthenticated arbitrary file read and remote code execution in CrushFTP CVE-2026-35477 InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape CVE-2026-26938 Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) CVE-2025-14700 Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller