{"action":"Upgrade ironic to 4.2.5 or later.","affected":[{"fixed":"4.2.5","introduced":"0"},{"fixed":"5.1.2","introduced":"5.0"}],"component":"ironic","cve_ids":["CVE-2016-4985"],"ecosystem":"PyPI","epss":0.0286,"exploited":false,"fixed_versions":["4.2.5","5.1.2"],"ghsa_id":"GHSA-f7cr-7c2c-fm8r","id":"tcs_01M5KHCNC4DG8PDN3XH84WB0TQ","modified_at":"2026-07-06T08:00:11.831286937Z","published_at":"2026-07-02T14:13:22.984032Z","references":["https://osv.dev/vulnerability/PYSEC-2026-646","https://nvd.nist.gov/vuln/detail/CVE-2016-4985","https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410","https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e","https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77","https://access.redhat.com/errata/RHSA-2016:1377","https://access.redhat.com/errata/RHSA-2016:1378","https://access.redhat.com/security/cve/CVE-2016-4985","https://bugs.launchpad.net/ironic/+bug/1572796","https://bugzilla.redhat.com/show_bug.cgi?id=1346193","https://github.com/openstack/ironic","https://review.openstack.org/332195","https://review.openstack.org/332196","https://review.openstack.org/332197","http://www.openwall.com/lists/oss-security/2016/06/21/6","https://pypi.org/project/ironic","https://github.com/advisories/GHSA-f7cr-7c2c-fm8r"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-646","url":"https://osv.dev/vulnerability/PYSEC-2026-646"}],"summary":"OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor"}