Three OpenStack Ironic advisories list flaws; snippets name no fixes

1 source · 2 articlesFirst reported Oct 22, 2026 · 18:55 UTCUpdated Oct 22, 2026 · 19:00 UTC (8d ago)1

What's new

October 29: Faulkner posted OSSA-2026-049, assigning CVE-2026-115638 to an Ironic conductor denial of service via a gzip-bomb configdrive; the snippet names no fix.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Three October OpenStack Ironic advisories describe path injection, a maintenance update, and a conductor DoS, with no fixes in the posts.

Jay Faulkner posted three OpenStack Ironic advisories to oss-security in October 2026. The feed snippets name the issues and affected version lists but end before impact details, fixes, or exploitation status. OSSA-2026-047 (CVE-2026-90458), posted October 22, says the Redfish vendor_passthru method allows path injection via an ID, affecting Ironic from 18.1.0 through 39.0.1. OSSA-2026-048 (CVE-2026-89419), also October 22, says Ironic allows a generic node update of the maintenance setting, affecting 17.0.0 through 39.0.1. The Metal3.io Security team reported both. On October 29, OSSA-2026-049 assigned CVE-2026-115638 to a conductor denial of service through a gzip-bomb configdrive, listing Ironic from 16.2.0 and builds before 39.0.1; Faulkner of G-Research reported that issue.

Key facts

OSSA-2026-047 / CVE-2026-90458: path injection via Redfish vendor_passthru ID.
OSSA-2026-047 affected range: Ironic >=18.1.0, 30.0.0, 33.0.0, 36.0.0, <=39.0.1.
OSSA-2026-048 / CVE-2026-89419: generic node update of the maintenance setting.
OSSA-2026-048 affected range: Ironic >=17.0.0, 30.0.0, 33.0.0, 36.0.0, <=39.0.1.
OSSA-2026-049 / CVE-2026-115638: conductor DoS via gzip-bomb configdrive.
OSSA-2026-049 lists >=16.2.0, =30.0.0, =33.0.0, =36.0.0 and <39.0.1.

Analyze CVE-2026-115638 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 22, 2026OSSA-2026-047 posted for Ironic path injection · oss-security
Oct 22, 2026OSSA-2026-048 posted for maintenance-setting node update · oss-security
Oct 29, 2026OSSA-2026-049 posted for gzip-bomb conductor DoS · oss-security

What each outlet adds

beyond the shared facts

oss-securityThree truncated Ironic OSSAs, CVE ids, version lists, and reporters

CVEs: CVE-2026-115638 CVE-2026-90458 CVE-2026-89419

Vendors: OpenStack
Products: Ironic
Organizations: G-Research Metal3.io Security Metal3.io

Coverage

oldest first · one row per article · UTC

Oct 22, 18:55 UTC · 8d ago oss-securityFirst report
Ironic Redfish vendor_passthru allows path injection (CVE-2026-90458)
OSSA-2026-047 lists Ironic from 18.1.0 through 39.0.1; the snippet does not name a fix.
Oct 22, 19:00 UTC · 8d ago oss-security
Ironic node update can change maintenance setting (CVE-2026-89419)
OSSA-2026-048 lists Ironic from 17.0.0 through 39.0.1; the posted description is cut off.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-90458 +2 related CVEs CVE-2026-89419 CVE-2026-115638	OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service	5.4 group max	—		8d ago