5.3
Medium
CVE-2026-50589 In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some…
Description
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ironic 32.0 | 32.0.0 → < 37.0.0 | 37.0.0 |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published |
References
- bugs.launchpad.net bugs.launchpad.net
- wiki.openstack.org wiki.openstack.org
Timeline
- Published
- Last modified
Other CVEs of Ironic
The 18 CVEs of Ironic →
CVE-2026-90458
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's…
5.4
Medium
CVE-2026-89419
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to…
5.0
Medium
CVE-2026-115638
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of…
4.3
Medium
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is…
6.3
Medium