PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44916 OpenStack CVE debrief

CVE-2026-44916 is a low-severity issue in OpenStack Ironic affecting versions before 35.0.2 in a certain non-default configuration. The published description says instance_info['ks_template'] is rendered without sandboxing. Public records show the CVE was first published on 2026-05-08 and later modified on 2026-05-20, with references to a Launchpad bug, an OpenStack security advisory, and an oss-security announcement.

Vendor
OpenStack
Product
Ironic
CVSS
LOW 3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-06-18
Advisory published
2026-05-08
Advisory updated
2026-06-18

Who should care

Operators and maintainers running OpenStack Ironic, especially environments that use the affected non-default ks_template configuration. Security teams that track OpenStack advisories and package updates should also review exposure.

Technical summary

NVD lists CVE-2026-44916 with CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N and CWE-1336. The issue affects OpenStack Ironic before 35.0.2 and involves rendering instance_info['ks_template'] without sandboxing in a non-default configuration. Based on the provided record, the impact is limited and the CVSS score is 3.0 (LOW).

Defensive priority

Low, but worth addressing during normal maintenance because the issue is publicly disclosed and a fixed release is available.

Recommended defensive actions

  • Upgrade OpenStack Ironic to 35.0.2 or later.
  • Check whether your deployment uses the affected non-default ks_template configuration.
  • Review configuration management and deployment templates for any use of instance_info['ks_template'].
  • Monitor the linked OpenStack security advisory and package/vendor update channels for remediation guidance.
  • If you cannot upgrade immediately, document affected hosts and limit exposure through change control and configuration review.

Evidence notes

All facts in this debrief are drawn from the supplied CVE record and its cited references. The CVE metadata shows publishedAt 2026-05-08T07:16:29.163Z and modifiedAt 2026-05-20T16:16:25.813Z. The description states the issue is in OpenStack Ironic before 35.0.2 and concerns unsandboxed rendering of instance_info['ks_template'] in a certain non-default configuration. NVD metadata lists CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N and CWE-1336, and the references include Launchpad bug 2148307, OSSA-2026-012, and an oss-security post.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44916 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44916

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44916 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44916

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.