CVE-2023-40585

ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place.

• CWE-306

• https://github.com/metal3-io/ironic-image/commit/f64bb6ce0945bbfb30d9965f98149ea183311de9Patch
• https://github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7Patch, Vendor Advisory
• https://github.com/metal3-io/ironic-image/commit/f64bb6ce0945bbfb30d9965f98149ea183311de9Patch
• https://github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7Patch, Vendor Advisory

Published

Aug 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4058Memory safety bugs present in Firefox 115. Some of these bug…9.8
• CVE-2023-40580Freighter is a Stellar chrome extension. It may be possible …6.5
• CVE-2023-40581yt-dlp is a youtube-dl fork with additional features and fix…7.8
• CVE-2023-40582find-exec is a utility to discover available shell commands.…9.8
• CVE-2023-40583libp2p is a networking stack and library modularized out of …7.5
• CVE-2023-40584Argo CD is a declarative continuous deployment for Kubernete…6.5
• CVE-2023-40586OWASP Coraza WAF is a golang modsecurity compatible web appl…7.5
• CVE-2023-40587Pyramid is an open source Python web framework. A path trave…5.3
• CVE-2023-40588Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-40589FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2023-4059The Profile Builder WordPress plugin before 3.9.8 lacks auth…4.3
• CVE-2023-40590 GitPython is a python library used to interact with Git rep…7.8