OpenStack Ironic <=38.0.0 leaks creds to remote host via HTTP Auth
CVE-2026-90461 Published on September 11, 2026
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Vulnerability Analysis
CVE-2026-90461 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Improper Restriction of Communication Channel to Intended Endpoints
The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Products Associated with CVE-2026-90461
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 24.0.0, <= 29.0.6 is affected.
- Version 30.0.0, <= 32.0.1 is affected.
- Version 33.0.0, <= 35.0.1 is affected.
- Version 36.0.0, <= 38.0.0 is affected.