⌘ + K

PYSEC-2026-646

Dashboard / Vulnerabilities / PYSEC-2026-646

PYSEC-2026-646

Published: 2 Jul 2026Last Modified: 6 Jul 2026

Aliases:

CVE-2016-4985

Summary: OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

Details: The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the `v1/drivers/$DRIVER_NAME/vendor_passthru` resource.

References: https://nvd.nist.gov/vuln/detail/CVE-2016-4985, https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410, https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e, https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77, https://access.redhat.com/errata/RHSA-2016:1377, https://access.redhat.com/errata/RHSA-2016:1378, https://access.redhat.com/security/cve/CVE-2016-4985, https://bugs.launchpad.net/ironic/+bug/1572796, https://bugzilla.redhat.com/show_bug.cgi?id=1346193, https://github.com/openstack/ironic, https://review.openstack.org/332195, https://review.openstack.org/332196, https://review.openstack.org/332197, http://www.openwall.com/lists/oss-security/2016/06/21/6, https://pypi.org/project/ironic, https://github.com/advisories/GHSA-f7cr-7c2c-fm8r

Affected packages

Package

Name: ironic

Purl: pkg:pypi/ironic

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -4.2.5

Affected versions

0.0

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High