What is CVE-2023-40585?

CVE-2023-40585 is a high-severity vulnerability in Metal3 Ironic-Image, classified under Missing Authentication for Critical Function. CVSS score: 7.3/10. Published 2023-08-25.

How severe is CVE-2023-40585?

High severity. CVSS v3 base score is 7.3 out of 10.

Auth bypass in Metal3 Ironic-Image

CVE-2023-40585

ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place.

Vulnerability class: Broken Authentication

Published 2023-08-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (35.3th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 35.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Metal3 Ironic-Image
Metal3-Io Ironic-Image — versions < capm3-v1.4.3

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

github.com/metal3-io/ironic-image/security/advisories/GHSA-jwpr-9fwh-m4g7 (Patch, Vendor Advisory)
github.com/metal3-io/ironic-image/commit/f64bb6ce0945bbfb30d9965f98149ea183311d… (Patch)

Frequently asked questions

What is CVE-2023-40585?: CVE-2023-40585 is a high-severity vulnerability in Metal3 Ironic-Image, classified under Missing Authentication for Critical Function. CVSS score: 7.3/10. Published 2023-08-25.
How severe is CVE-2023-40585?: High severity. CVSS v3 base score is 7.3 out of 10.