CVE-2026-90458: [OSSA-2026-047] Ironic: dfish vendor_passthru method allows path injection via ID (CVE-2026-90458)

Q: Who can exploit this issue?

An attacker needs network access to the affected Ironic service and low-privileged access, as reflected by the PR:L attack vector. No user interaction is required.

Q: What operations can an attacker perform through the vulnerable interface?

The issue allows GET and DELETE requests through vendor_passthru by injecting a path through an ID. The advisory example notes that this can be used to delete accounts from a BMC's Redfish service.

Q: Which deployments are affected?

OpenStack Ironic versions before 39.0.1 are affected. The provided information does not identify any configuration prerequisite or indicate that the vulnerable method must be explicitly enabled.

Published Oct 22, 2026

Updated

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service.

Affected Software

1 affected component

Openstack Ironic<39.0.1

Event History

Oct 23, 2026

CVE Published

via MITRE·03:50 AM

Data Sourced

via MITRE·03:50 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs network access to the affected Ironic service and low-privileged access, as reflected by the PR:L attack vector. No user interaction is required.

What operations can an attacker perform through the vulnerable interface?

The issue allows GET and DELETE requests through vendor_passthru by injecting a path through an ID. The advisory example notes that this can be used to delete accounts from a BMC's Redfish service.

Which deployments are affected?

OpenStack Ironic versions before 39.0.1 are affected. The provided information does not identify any configuration prerequisite or indicate that the vulnerable method must be explicitly enabled.

CVE-2026-90458: [OSSA-2026-047] Ironic: dfish vendor_passthru method allows path injection via ID (CVE-2026-90458)

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What operations can an attacker perform through the vulnerable interface?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What operations can an attacker perform through the vulnerable interface?

Which deployments are affected?