Medium
5.0
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a...
CVE-2026-89419
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| OpenStack | Ironic |
≥ 17.0.0, < 29.1.1 ≥ 30.0.0, < 32.1.1 ≥ 33.0.0, < 35.1.1 ≥ 36.0.0, < 39.0.1 |
29.1.1 32.1.1 35.1.1 39.0.1 |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-89419 ironic
- Ubuntu UBUNTU-CVE-2026-89419 ironic
Original description The description as published by the source.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
Source: oss-security (Openwall) NVD GitHub Advisory
References
- OSS-SECURITY [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419)
- REDHAT Red Hat
- web cve@mitre.org
- web cve@mitre.org
- web openwall.com
- web nvd.nist.gov
- web github.com