{"action":"Upgrade ironic to 24.1.3 or later.","affected":[{"fixed":"24.1.3","introduced":"0"},{"fixed":"26.1.1","introduced":"25.0.0"},{"fixed":"29.0.1","introduced":"27.0.0"}],"component":"ironic","cve_ids":["CVE-2025-44021"],"ecosystem":"PyPI","epss":0.0019,"exploited":false,"fixed_versions":["24.1.3","26.1.1","29.0.1"],"ghsa_id":"GHSA-q3m2-crgq-5p3q","id":"tcs_01M5KGPMACHP5T7EG0EPM8T3SH","modified_at":"2026-06-10T17:01:52.623930600Z","published_at":"2025-05-08T17:16:01Z","references":["https://osv.dev/vulnerability/PYSEC-2025-38","https://bugs.launchpad.net/ironic/+bug/2107847","https://security.openstack.org/ossa/OSSA-2025-001.html","https://github.com/advisories/GHSA-q3m2-crgq-5p3q"],"severity":{"label":"low","score":2.8},"sources":[{"source":"osv","source_id":"PYSEC-2025-38","url":"https://osv.dev/vulnerability/PYSEC-2025-38"},{"source":"nvd","source_id":"CVE-2025-44021","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-44021"}],"summary":"OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can prov"}