CVE-2026-89419Medium· 5.0▾ SunlitOpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
Ironic >= 17.0.0 < 29.1.1Ironic >= 30.0.0 < 32.1.1Ironic >= 33.0.0 < 35.1.1Ironic >= 36.0.0 < 39.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115638Medium· 4.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
CVE-2026-90458Medium· 5.4OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
CVE-2026-90461Medium· 6.3OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
CVE-2026-54421Medium· 6.8OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
CVE-2026-50589Medium· 5.3OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
CVE-2026-46447Medium· 5.8OpenStack Ironic allows Boot Script Injection