The vulnerability in OpenStack Ironic allows untrusted ks_template data to be rendered unsafely in versions before 35.0.2 and when a non‑default configuration is used. This unsandboxed rendering creates a template injection flaw. Based on the description, it is inferred that an attacker might be able to execute arbitrary template code within the Ironic service, potentially compromising the integrity and confidentiality of the environment and its managed data.

OpenStack Ironic releases before version 35.0.2 are affected when a non‑default configuration is used. Deployments running those versions with user‑supplied ks_template content are vulnerable; newer releases (35.0.2 and later) are not confirmed to contain the issue.

The CVSS score of 3 indicates low severity. The EPSS score of <1% indicates a very low probability of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is user‑supplied instance metadata that includes a ks_template payload; an attacker with privileges to submit such metadata could exploit the flaw. Because the vulnerability requires input from a user of the Ironic service, exploitation is limited to those with provisioning rights.