Skip to content
Sign in
6.8 Medium

CVE-2026-54421 In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized…

Description

In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

Affected products and versions

Product Affected versions Fixed in
Ironic 36.0 36.0.0 → < 37.0.1 37.0.1
Ironic 33.0 33.0.0 → < 35.0.2 35.0.2
Ironic 30.0 30.0.0 → < 32.0.2 32.0.2
Ironic 17.0 17.0.0 → < 29.0.6 29.0.6

Other CVEs of Ironic

The 18 CVEs of Ironic →
CVE-2026-90458 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's… 5.4 Medium CVE-2026-89419 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to… 5.0 Medium CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of… 4.3 Medium CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is… 6.3 Medium
Track this CVE