CVE-2026-89419: [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419)

Q: Which Ironic versions are affected?

OpenStack Ironic versions before 39.0.1 are affected.

Q: What level of access is required to exploit this issue?

The CVSS vector indicates that an attacker needs low privileges. Exploitation involves sending a PATCH request to the generic /v1/nodes/{ident} endpoint.

Published Oct 22, 2026

Updated

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

Affected Software

1 affected component

Openstack Ironic<39.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenStack Ironic to a version that resolves this vulnerability.
Fixed in 39.0.1

Event History

Oct 23, 2026

CVE Published

via MITRE·03:44 AM

Data Sourced

via MITRE·03:44 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Ironic versions are affected?

OpenStack Ironic versions before 39.0.1 are affected.

What level of access is required to exploit this issue?

The CVSS vector indicates that an attacker needs low privileges. Exploitation involves sending a PATCH request to the generic /v1/nodes/{ident} endpoint.

CVE-2026-89419: [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ironic versions are affected?

What level of access is required to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which Ironic versions are affected?

What level of access is required to exploit this issue?