Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) security update
A security vulnerability (CVE-2026-42997) affecting Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) allows information disclosure via credential forwarding during mold import. The issue relates to the Ironic project, which provisions bare metal machines using technologies like PXE boot and IPMI. Red Hat has issued an important security update to address this vulnerability.
AI Analysis
Technical Summary
The vulnerability CVE-2026-42997 in OpenStack Ironic component of Red Hat OpenStack Services on OpenShift 18.0 involves information disclosure caused by credential forwarding during mold import. Ironic provisions bare metal machines and supports pluggable drivers for vendor-specific functionality. This flaw could lead to unintended exposure of sensitive credentials. Red Hat has released an update (openstack-ironic-21.4.5-18.0.20260616204937) to fix this issue as detailed in advisory RHSA-2026:39811.
Potential Impact
The vulnerability allows unauthorized disclosure of credentials during the mold import process in OpenStack Ironic, potentially exposing sensitive information. This could undermine the security of bare metal provisioning operations managed by OpenStack Ironic on OpenShift 18.0. No known exploits in the wild have been reported.
Mitigation Recommendations
Red Hat has released an official security update for openstack-ironic in Red Hat OpenStack Services on OpenShift 18.0 to address CVE-2026-42997. Users should apply the update as described in Red Hat advisory RHSA-2026:39811 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerability.
Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) security update
Description
A security vulnerability (CVE-2026-42997) affecting Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) allows information disclosure via credential forwarding during mold import. The issue relates to the Ironic project, which provisions bare metal machines using technologies like PXE boot and IPMI. Red Hat has issued an important security update to address this vulnerability.
Affected software
pkg:rpm/redhat/openstack-ironicRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-42997 in OpenStack Ironic component of Red Hat OpenStack Services on OpenShift 18.0 involves information disclosure caused by credential forwarding during mold import. Ironic provisions bare metal machines and supports pluggable drivers for vendor-specific functionality. This flaw could lead to unintended exposure of sensitive credentials. Red Hat has released an update (openstack-ironic-21.4.5-18.0.20260616204937) to fix this issue as detailed in advisory RHSA-2026:39811.
Potential Impact
The vulnerability allows unauthorized disclosure of credentials during the mold import process in OpenStack Ironic, potentially exposing sensitive information. This could undermine the security of bare metal provisioning operations managed by OpenStack Ironic on OpenShift 18.0. No known exploits in the wild have been reported.
Mitigation Recommendations
Red Hat has released an official security update for openstack-ironic in Red Hat OpenStack Services on OpenShift 18.0 to address CVE-2026-42997. Users should apply the update as described in Red Hat advisory RHSA-2026:39811 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:39811
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a577ecf68715ace43b3f2b2
Added to database: 07/15/2026, 12:36:31 UTC
Last enriched: 07/15/2026, 12:41:26 UTC
Last updated: 07/16/2026, 04:34:29 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.