The vulnerability CVE-2026-42997 in OpenStack Ironic (prior to 35.0.1) is categorized under CWE-669 (Incorrect Resource Transfer Between Spheres). During the import operation, a user invoking molds can request that authorization credentials be sent to a remote endpoint. These credentials include a time-limited Keystone token, which grants access to all OpenStack services that Ironic is authorized to access, or basic credentials configured for molds storage. This behavior can lead to unintended credential disclosure. The issue has been addressed in versions 26.1.6, 29.0.5, 32.0.1, and 35.0.1. The CVSS v3.1 base score is 7.7 (High), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. Red Hat has issued an important security advisory with updated packages to fix this vulnerability in their OpenStack Services on OpenShift 18.0 distribution.

The vulnerability allows an attacker with low privileges to cause OpenStack Ironic to forward sensitive authorization credentials (Keystone tokens or basic credentials) to a remote endpoint during mold import. This can lead to high confidentiality impact by exposing credentials that provide access to all OpenStack services authorized for Ironic. There is no impact on integrity or availability. The scope of the vulnerability is changed, meaning the impact extends beyond the vulnerable component.

A fix is available and has been released in OpenStack Ironic versions 26.1.6, 29.0.5, 32.0.1, and 35.0.1. Red Hat has published an important security advisory (RHSA-2026:39811) with updated packages for Red Hat OpenStack Services on OpenShift 18.0 to address this issue. Users should apply these updates promptly to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.