In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step postcss: PostCSS: Information disclosure via crafted sourceMappingURL tar: node-tar: Denial of Service via crafted long-path tar archive

Affected: Ubuntu:16.04:LTS: ironic, Ubuntu:18.04:LTS: ironic, Ubuntu:20.04:LTS: ironic, Ubuntu:22.04:LTS: ironic, Ubuntu:24.04:LTS: ironic, Ubuntu:25.10: ironic, Ubuntu:26.04:LTS: ironic

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.