CVE-2026-42510 — OpenStack Ironic through 25.0.0 allows ipmitool execution

title: CVE-2026-42510 - OpenStack Ironic ipmitool Execution via Console Interface
id: scw-2026-04-28-ai-1
status: experimental
level: high
description: |
  Detects the execution of 'ipmitool' which is leveraged by CVE-2026-42510 in OpenStack Ironic. This rule specifically looks for 'ipmitool' being run in conjunction with 'openstack' and 'ironic' in the command line, indicating a potential exploitation of the vulnerability in a non-default configuration with a console interface.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42510/
tags:
  - attack.privilege_escalation
  - attack.t1207
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'ipmitool'
      CommandLine|contains:
          - 'openstack'
          - 'ironic'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse