Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a command injection flaw within the IPMI-over-SoCAT console functionality of OpenStack Ironic. The issue originates from insufficient sanitization of user-provided data from a node's driver_info, such as the ipmi_address. The IPMIConsole.get_console method in ironic/drivers/modules/ipmitool.py constructs an ipmitool command string by joining arguments with spaces, without sanitizing the values which may contain shell metacharacters.
This improperly constructed command string is then passed to the start_socat_console function located in ironic/drivers/modules/console_utils.py. This function, prior to being patched, would pass the command string directly to socat's EXEC parameter without the necessary shell escaping. This allows an attacker with permissions to modify a node's driver_info to inject arbitrary commands. These commands would then be executed on the ironic conductor host with the privileges of the ironic conductor process. The vulnerability is patched by applying shlex.quote() within the start_socat_console function to ensure the command string is properly escaped before execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ironic | pip | < 35.0.1 | 35.0.1 |
