CVE-2026-90461: Medium severity Openstack Ironic vulnerability
Published Sep 11, 2026
·Updated
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Affected Software
1 affected component
Openstack Ironic<=38.0.0
Event History
Sep 11, 2026
CVE Published
via MITRE·09:32 PM
Data Sourced
via MITRE·09:32 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed to this issue?
Deployments of OpenStack Ironic through 38.0.0 are exposed when the Image Service is configured to use HTTP(S) Basic Authentication.
2
What would an attacker need to obtain?
An attacker would need to cause Ironic to communicate with an unexpected remote host. In the affected configuration, Ironic may send the configured Image Service username and password to that host.
3
How can I determine whether my environment is affected?
Check whether your OpenStack Ironic version is 38.0.0 or earlier and whether its Image Service configuration uses HTTP(S) Basic Authentication. Both conditions are identified as relevant to this issue.