OpenStack Ironic <39.0.1 DELETE/GET via vendor_passthru Redfish BMC
CVE-2026-90458 Published on October 23, 2026
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
Vulnerability Analysis
CVE-2026-90458 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Products Associated with CVE-2026-90458
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 18.1.0 and below 29.1.1 is affected.
- Version 30.0.0 and below 32.1.1 is affected.
- Version 33.0.0 and below 35.1.1 is affected.
- Version 36.0.0 and below 39.0.1 is affected.