Loading story…
OpenStack disclosed OSSA-2026-008 for a command injection vulnerability in Ironic IPMI console implementations, later assigned CVE-2026-42510. The flaw allows a project manager designated as a node.owner to inject arbitrary commands that are executed by an Ironic conductor when a console session is activated. The issue was reported by Dmitry Tantsur and Tuomo Tanskanen of the Metal3.io Security Team.
The vulnerability affects specific Ironic versions only when the optional ipmitool-shellinabox or ipmitool-socat console interfaces are explicitly enabled through enabled_console_interfaces; OpenStack noted that console backends are disabled by default. Patches were released for maintained and some unmaintained branches, and OpenStack warned that ipmitool-shellinabox is already slated for removal because of security support concerns, urging security-sensitive operators to stop using it immediately.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
OpenStack published an errata update for OSSA-2026-008 stating that the vulnerability had been assigned CVE-2026-42510. The update reiterated that console backends are disabled by default and urged security-sensitive operators to stop using ipmitool-shellinabox immediately.
OpenStack disclosed OSSA-2026-008 for a command injection vulnerability affecting specific Ironic versions when the optional ipmitool-shellinabox or ipmitool-socat console interfaces are enabled. Patches were released for maintained and some unmaintained branches, and operators were warned that ipmitool-shellinabox was already slated for removal due to security concerns.
Dmitry Tantsur and Tuomo Tanskanen of the Metal3.io Security Team reported a command injection flaw in OpenStack Ironic's IPMI console implementations. The issue allows a project manager designated as a node.owner to inject commands that are executed by an Ironic conductor during console activation when certain optional console interfaces are enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenStack disclosed that **Ironic Python Agent (IPA)** versions `3.7.0` through `11.6.1` can unexpectedly fall back to multicast DNS (**mDNS**) when the agent boots without a valid API URL, allowing it in rare cases to discover and connect to an unintended Ironic API service on the local network. The issue primarily affects specialized bare-metal bootstrap workflows such as virtual media or USB-based provisioning, because standard Ironic-managed deployments normally provide a valid API URL and do not rely on discovery behavior. To reduce the risk, OpenStack changed IPA so mDNS fallback is no longer automatic and must be explicitly enabled with settings such as ``` ipa-api-url=mdns ``` or ``` ipa-use-mdns=True ```. Reporting on the disclosure also highlighted a separate July fix in the same component, where the `ntp_server` value could be inserted into a shell command without proper validation, creating a potential root-level command injection path during early boot; together, the issues underscore the security sensitivity of pre-OS provisioning paths. No CVE was assigned to the mDNS fallback issue, and operators were advised to verify that IPA boots are managed by Ironic and to review any environments that intentionally depend on mDNS before upgrading.
Aug 5, 2026
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026