CVE-2026-46447 is a vulnerability in OpenStack Ironic before version 35.0.2 where an attacker who can set node.driver_info or node.instance_info can perform boot script injection of an iPXE script. This represents an incorrect resource transfer between spheres (CWE-669), potentially allowing the attacker to influence the boot process. The vulnerability has a CVSS 3.1 base score of 5.8, with network attack vector, high attack complexity, requiring high privileges, no user interaction, and a scope change. The impact is integrity loss without confidentiality or availability impact.

An attacker with the ability to modify node.driver_info or node.instance_info can inject a malicious iPXE boot script, potentially compromising the integrity of the boot process. This could allow unauthorized code execution during system boot. The vulnerability does not impact confidentiality or availability directly. The attack requires high privileges and has a high attack complexity, limiting exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 35.0.2, upgrading to version 35.0.2 or later is likely the intended remediation once available. Until an official fix is confirmed, restrict access to node.driver_info and node.instance_info settings to trusted administrators only to reduce risk.