OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.

References

• https://bugs.launchpad.net/ironic/+bug/2148331
• http://www.openwall.com/lists/oss-security/2026/04/30/1