CVE-2015-5306: Injection vulnerability in ironic-discoverd
Summary
CVE-2015-5306: Injection vulnerability that affects ironic-discoverd. Affects python-ironic-inspector-client versions < 0.2.5. Fixed in 0.2.5. How to fix ↓
Also tracked for
- ironic-inspector · Debian:11
- ironic-inspector · PyPI
The same CVE-2015-5306 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd) is a component of the OpenStack Ironic project. It is responsible for discovering and inspecting bare metal nodes. The ironic-discoverd service runs in debug mode, which allows remote attackers to access the Flask console and potentially execute arbitrary Python code by triggering an error.
Vulnerability Detail
The vulnerability in ironic-discoverd arises when debug mode is enabled. This mode exposes the Flask console, which can be accessed remotely by attackers. By triggering an error, attackers can inject and execute arbitrary Python code, potentially leading to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Latest published version: 5.4.0 as of 23 Oct 2026
pip install --upgrade "python-ironic-inspector-client==5.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.5
This is the first release that contains the fix.
pip install --upgrade "python-ironic-inspector-client==0.2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to ensure that debug mode is disabled in the ironic-discoverd configuration. This can be achieved by modifying the configuration file and setting the 'debug' option to 'False'. Here is an example of how to modify the configuration file:
# Open the configuration file
sudo nano /etc/ironic-discoverd/ironic-discoverd.conf
# Find the 'debug' option and set it to 'False'
debug = False
# Save the changes and exit the editor
Conclusion
The injection vulnerability in ironic-discoverd can be mitigated by disabling debug mode and keeping the ironic-inspector-client package updated. It is crucial to promptly apply these fixes to ensure the security and integrity of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-ironic-inspector-client →
FAQ
Ironic-discoverd is a component of the OpenStack Ironic project that is responsible for discovering and inspecting bare metal nodes. It helps in the provisioning and management of physical servers.
The injection vulnerability in ironic-discoverd occurs when debug mode is enabled. This mode exposes the Flask console, which can be accessed remotely by attackers. By triggering an error, attackers can inject and execute arbitrary Python code.
The injection vulnerability in ironic-discoverd can lead to unauthorized access, data manipulation, or other malicious activities. Attackers can execute arbitrary Python code, potentially compromising the security and integrity of the system.
To fix this vulnerability, it is recommended to disable debug mode in the ironic-discoverd configuration. Additionally, ensure that the ironic-inspector-client package is updated to version 0.2.5 or higher.
Yes, a workaround for this vulnerability is to disable debug mode in the ironic-discoverd configuration. This can be achieved by modifying the configuration file and setting the 'debug' option to 'False'.
