Medium
5.4
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete...
CVE-2026-90458
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| OpenStack | Ironic |
≥ 18.1.0, < 29.1.1 ≥ 30.0.0, < 32.1.1 ≥ 33.0.0, < 35.1.1 ≥ 36.0.0, < 39.0.1 |
29.1.1 32.1.1 35.1.1 39.0.1 |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-90458 ironic
- Ubuntu UBUNTU-CVE-2026-90458 ironic
Original description The description as published by the source.
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
Source: oss-security (Openwall) NVD GitHub Advisory
References
- OSS-SECURITY [OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458)
- REDHAT Red Hat
- web cve@mitre.org
- web cve@mitre.org
- web openwall.com
- web nvd.nist.gov
- web github.com