OpenStack Ironic <39.0.1: Unauthorized Maintenance Toggle via PATCH
CVE-2026-89419 Published on October 23, 2026
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
Vulnerability Analysis
CVE-2026-89419 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Products Associated with CVE-2026-89419
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 17.0.0 and below 29.1.1 is affected.
- Version 30.0.0 and below 32.1.1 is affected.
- Version 33.0.0 and below 35.1.1 is affected.
- Version 36.0.0 and below 39.0.1 is affected.