https://seclists.org/oss-sec/2026/q4/308: [OSSA-2026-047] Ironic: dfish vendor_passthru method allows path injection via ID (CVE-2026-90458)
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
Openstack Ironic
Frequently Asked Questions
1
Which deployments are exposed?
Only clouds that have nodes enrolled with the redfish hardware type are susceptible. The affected API behavior is in the redfish management interface's vendor_passthru endpoint when creating or deleting a subscription.
2
What level of access does an attacker need?
Exploitation requires a malicious System-scoped Administrator. That administrator can use the endpoint to cause HTTP GET or DELETE requests to an arbitrary path on a node's BMC.
3
What could an attacker do to an affected BMC?
The attacker may access arbitrary BMC paths using HTTP GET or DELETE requests. In the worst case described, this could delete user accounts from the BMC's Redfish service.
4
What patch branches are listed?
Patches are listed for 2024.1/caracal, 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, 2026.2/hibiscus, and 2027.1/indigo. The advisory identifies 2024.1/caracal as unmaintained.