Ironic node update can change maintenance setting (CVE-2026-89419)
Original title: [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419)
OSSA-2026-048 lists Ironic from 17.0.0 through 39.0.1; the posted description is cut off.
Jay Faulkner posted OpenStack advisory OSSA-2026-048 on October 22, 2026. It says Ironic allows a generic node update for the maintenance setting, tracked as CVE-2026-89419. The Metal3.io Security team reported the issue. The feed snippet ends before impact, fixes, or exploitation status.
Unconfirmed: The snippet is truncated, so impact details, fixes, and exploitation status are unstated.
- Affected Ironic ranges are listed as >=17.0.0, 30.0.0, 33.0.0, 36.0.0 and <=39.0.1.
- No fixed version appears in the snippet.
- The description stops after naming the Metal3.io Security team.
Impact: generic node update of the maintenance setting
| Product | Affected |
|---|---|
| OpenStack Ironic | >=17.0.0 30.0.0 33.0.0 36.0.0 <=39.0.1 |
- CVEs
- CVE-2026-89419
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89419 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using… | 5.0 | — |
From the original article
Posted by Jay Faulkner on Oct 22 ======================================================================== OSSA-2026-048: Ironic allows generic node update for maintenance setting ======================================================================== :Date: October 22, 2026 :CVE: CVE-2026-89419 Affects ~~~~~~~ - Ironic: >=17. 0. 0 30.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.