OpenStack Ironic conductor DoS via gzip-bomb configdrive
OSSA-2026-049 assigns CVE-2026-115638 and lists Ironic lines from 16.2.0 through builds before 39.0.1.
48
Product
Ironic
- Mentions · 7d1
- Mentions · 30d4
- All mentions4
- First seenOct 9, 2026
- Last mentioned1d ago
Timeline
4 articles · newest firstIronic node update can change maintenance setting (CVE-2026-89419)
OSSA-2026-048 lists Ironic from 17.0.0 through 39.0.1; the posted description is cut off.
40
Ironic Redfish vendor_passthru allows path injection (CVE-2026-90458)
OSSA-2026-047 lists Ironic from 18.1.0 through 39.0.1; the snippet does not name a fix.
48
[OSSN-0110] Ironic can leak basic auth credentials to image server
OpenStack Ironic can leak HTTP basic-auth credentials to a configured image server.
48
Related CVEs
by mentions- OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service
- OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…
- Gzip-bomb DoS in OpenStack Ironic configdrive through 39.0.1
Appears with
- OpenStackvendor · 4
- Metal3.ioorganization · 2
- G-Researchorganization · 1
- Metal3.io Securityorganization · 1
- Red Hatorganization · 1
- Ericsson Software Technologyorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.