CVE-2026-90461: Medium severity Openstack Ironic vulnerability
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ironicto a version that resolves this vulnerability.Fixed in 1:39.0.0-1 - Upgrade
Upgrade
debian/ironicto a version that resolves this vulnerability.Fixed in 1:39.0.0-6Fixed in 1:39.0.0-7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of OpenStack Ironic through 38.0.0 are exposed when the Image Service is configured to use HTTP(S) Basic Authentication.
What would an attacker need to obtain?
An attacker would need to cause Ironic to communicate with an unexpected remote host. In the affected configuration, Ironic may send the configured Image Service username and password to that host.
How can I determine whether my environment is affected?
Check whether your OpenStack Ironic version is 38.0.0 or earlier and whether its Image Service configuration uses HTTP(S) Basic Authentication. Both conditions are identified as relevant to this issue.