Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2026-42997 is a high-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Openstack Ironic. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-42997 affects the iDRAC component in OpenStack Ironic versions before 35.0.1. The vulnerability arises during the import process when a user invoking molds can request that authorization credentials be forwarded to a remote endpoint under their control. These credentials include either a time-limited Keystone token, which grants access to all OpenStack services that Ironic is authorized for, or basic credentials configured for molds storage. The issue is classified under CWE-669 and carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
A low-privileged user (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). By specifying a malicious remote endpoint during molds import, the attacker receives the sensitive credentials, enabling high confidentiality impact (C:H) in a scoped context (S:C). This could allow the attacker to leverage the Keystone token for unauthorized access across authorized OpenStack services or use the basic credentials for molds storage.
OpenStack Security Advisory OSSA-2026-010 addresses the vulnerability, with fixes released in OpenStack Ironic versions 26.1.6, 29.0.5, 32.0.1, and 35.0.1. Security practitioners should upgrade to these versions to mitigate the issue. Further technical details are provided in the oss-security mailing list announcements at the referenced URLs.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27428
Vulnerability Data
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all…
more
OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 2 OS baselines
V14.2.3
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces policy-based information flow rules that block transmission of sensitive data to unauthorized actors.
Enforces authorizations on logical access so that sensitive data is not released to unauthorized recipients.
Prevents unintended information leakage through shared system resources when crossing sphere boundaries.
Monitors and controls communications at external and key internal boundaries to block unauthorized transfers between trust domains.
Requires validation of outbound information to ensure sensitive content is not disclosed in responses or messages.
Separates user functionality from system management functions to avoid improper resource or behavior transfer between privilege spheres.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege authorization policies directly constrain resource transfers across security domains.
Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.
Monitoring runtime data flows and outputs can detect sensitive data being transmitted.
Protecting data-in-transit can limit exposure during inter-sphere transfers but does not address control-flow or authorization errors.
Protecting data-in-use includes removing confidential values before they are processed or sent.
Logical segmentation and access controls reduce unintended cross-sphere resource movement.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
Environment separation limits unintended resource leakage between spheres.
Classification identifies sensitive data so it is not inadvertently transmitted.
Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.
Information-transfer rules can prevent improper resource hand-off between spheres.
Access-control policies limit unintended control over transferred resources.