This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-90461 →

DEBIAN-CVE-2026-90461

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authe...

Original description

The description as published by the source.

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ironic

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 ironic

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 ironic

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org