OpenStack Ironic prior to version 35.0.1 contains a vulnerability (CVE-2026-42510) where ipmitool can be executed in configurations that enable a console interface, which is not the default setup. This issue is categorized as CWE-829, meaning that functionality from an untrusted control sphere is included, potentially allowing unauthorized or unintended command execution. The vulnerability affects multiple versions including 4.3.0, 27.0.0, 30.0.0, and 33.0.0. The CVSS 3.1 score of 6.6 indicates a medium severity with network attack vector, high attack complexity, requiring privileges, and no user interaction, impacting confidentiality, integrity, and availability.

Successful exploitation could lead to high impact on confidentiality, integrity, and availability of the affected system due to unauthorized execution of ipmitool commands. This could allow an attacker with required privileges to perform potentially harmful operations via the console interface in non-default configurations. However, exploitation requires high attack complexity and privileges, and no known exploits are reported in the wild.

No official patch or remediation level has been published by the vendor as of now. Users should monitor the OpenStack project advisories for updates and plan to upgrade to version 35.0.1 or later once available. Until then, avoid enabling non-default configurations that expose the console interface or restrict access to trusted administrators only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.