[OSSN-0110] Ironic can leak basic auth credentials to image server
OpenStack Ironic can leak HTTP basic-auth credentials to a configured image server.
OpenStack Security Note OSSN-0110, posted 8 October 2026, warns that Ironic can leak HTTP(S) basic-auth credentials to a configured image server. Dmitry Tantsur of Red Hat and Tuomo Tanskanen of Ericsson Software Technology, from the Metal3.io security team, reported the issue. It is triggered when the [deploy]/image_server_auth_strategy option is set to HTTP(S) Basic authentication. The posting does not mention a CVE or in-the-wild exploitation.
- OSSN-0110 describes a credential leak in OpenStack Ironic.
- Leak occurs when image_server_auth_strategy uses HTTP(S) basic auth.
- Reported by Red Hat and Ericsson researchers through Metal3.io.
- The note does not describe active exploitation.
- Vendors
- OpenStack
- Products
- Ironic
- Organizations
- Red HatEricsson Software TechnologyMetal3.io
From the original article
Posted by Jay Faulkner on Oct 08 ============================================================= OSSN-0110: Ironic can leak basic auth credentials to image server (2026-10-08) ============================================================= Summary ~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3. io security team reported a vulnerability in Ironic.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.