Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Ironic Redfish vendor_passthru allows path injection (CVE-2026-90458)

Original title: [OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458)

oss-security ()1
Read at seclists.org
Part of a story covered by 2 sourcesThree OpenStack Ironic advisories list flaws; snippets name no fixesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

OSSA-2026-047 lists Ironic from 18.1.0 through 39.0.1; the snippet does not name a fix.

OpenStack advisory OSSA-2026-047 says Ironic’s Redfish vendor_passthru method allows path injection via an ID, tracked as CVE-2026-90458. Jay Faulkner posted the notice on October 22, 2026. Listed affected releases are Ironic >=18.1.0, 30.0.0, 33.0.0, 36.0.0, and <=39.0.1. The feed snippet cuts off at the Metal3.io Security team’s description, so impact details and any fix are not included.

Unconfirmed: The snippet does not state a fixed version or whether the flaw is exploited.

Key facts
  • The advisory identifier is OSSA-2026-047.
  • The flaw is path injection through the Redfish vendor_passthru ID.
  • The notice is dated October 22, 2026.
  • The published description is truncated after naming Metal3.io Security.
Security assessment · AI, from the article

Impact: Path injection through the Redfish vendor_passthru ID

ProductAffected
OpenStack Ironic>=18.1.0 30.0.0 33.0.0 36.0.0 <=39.0.1
Analyze CVE-2026-90458 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-90458
Tags
ironicopenstackredfishpath-injectionmetal3
Vendors
OpenStack
Products
Ironic
Organizations
Metal3.io Security

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-90458
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service
5.4—

From the original article

Posted by Jay Faulkner on Oct 22 ========================================================================== OSSA-2026-047: Redfish vendor_passthru method allows path injection via ID ========================================================================== :Date: October 22, 2026 :CVE: CVE-2026-90458 Affects ~~~~~~~ - Ironic: >=18. 1. 0 30.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.