Description

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-11T22:16:48.403Z",
  "pubdate": "2026-09-11T22:16:48.403Z",
  "executiveSummary": "OpenStack Ironic is susceptible to an authentication credential leakage vulnerability when integrated with Image Service configurations utilizing HTTP(S) Basic Authentication.\nThe vulnerability occurs when Ironic erroneously transmits sensitive username and password credentials to unintended remote endpoints.\nThis flaw represents an information disclosure risk, potentially allowing an attacker to intercept administrative credentials used for authentication against the Image Service.\nThe impact includes unauthorized credential acquisition, which can facilitate further exploitation or lateral movement within the cloud infrastructure.\nAffected systems include OpenStack Ironic versions up to 38.0.0.\nExploitation does not necessarily require complex internal access if an attacker can influence the configuration or the redirection target of the affected service requests.",
  "technicalDetails": "The vulnerability stems from improper handling of HTTP(S) Basic Authentication headers during cross-service communication between OpenStack Ironic and the configured Image Service.\nIn scenarios where the Image Service configuration is misdirected or intercepted, Ironic fails to restrict the propagation of authentication headers to non-trusted or unexpected remote hosts.\nWhen Ironic initiates a request to the Image Service, it constructs an Authorization header containing the credentials. If the request is redirected or improperly routed to a third-party host due to environmental configuration or a malicious actor intercepting the request, the HTTP(S) client library within Ironic persists the transmission of the Basic Authentication credentials to the destination host.\nThe root cause is a lack of validation or origin-matching logic when following redirects or resolving the target URL, leading to the leakage of credentials in plain text (encoded in Base64 within the header).\nAttack flow: An attacker who can influence the Image Service URL configuration or spoof DNS/network responses can redirect Ironic's requests to a malicious server. Upon reaching the malicious endpoint, the server will capture the Authorization header containing the valid credentials intended for the legitimate Image Service.\nImpact: Successful exploitation results in the exposure of valid credentials used by Ironic to authenticate against the Image Service. This information can be leveraged by an attacker to gain unauthorized access to images stored within the OpenStack environment, potentially leading to unauthorized data access, image manipulation, or further exploitation of the OpenStack ecosystem.\nThe vulnerability persists in all versions up to 38.0.0. The lack of strict origin enforcement during header transmission allows for this persistent credential exposure."
}