CVE-2026-54421

Summary

In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

Affected Software

VendorProductVersion RangeStatus
OpenStackIronic17.0.0 < 29.0.6affected
OpenStackIronic30.0.0 < 32.0.2affected
OpenStackIronic33.0.0 < 35.0.2affected
OpenStackIronic36.0.0 < 37.0.1affected

Weaknesses

  • CWE-212: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References