Ironic node update can change maintenance setting (CVE-2026-89419)
OSSA-2026-048 lists Ironic from 17.0.0 through 39.0.1; the posted description is cut off.
40
Organization
Metal3.io
- Mentions · 7d0
- Mentions · 30d2
- All mentions2
- First seenOct 9, 2026
- Last mentioned8d ago
Timeline
2 articles · newest first[OSSN-0110] Ironic can leak basic auth credentials to image server
OpenStack Ironic can leak HTTP basic-auth credentials to a configured image server.
48
Related CVEs
by mentions- OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…
Appears with
- OpenStackvendor · 2
- Ironicproduct · 2
- Red Hatorganization · 1
- Ericsson Software Technologyorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.