PT-2026-49105 · Openstack · Openstack Ironic

Published 2026-06-14 · Updated 2026-06-14 · CVE-2026-54421

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 35.0.2

Description When applying a PATCH request to update fields in volume properties for which a user is authorized, the system may return unredacted sensitive information, such as iSCSI credentials. This issue specifically occurs during the PATCH operation, whereas the POST operation does not result in this disclosure.

Recommendations Update to version 35.0.2 or later.

Fix

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2026-54421

Affected Products

Openstack Ironic

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-54421 · Security Note
• https://twitter.com/VulmonFeeds/status/2066019061813698686 · Twitter Post
• https://bugs.launchpad.net/ironic/+bug/2155049 · Note