UNKNOWN OpenStack
CVE-2026-89419
OSSA-2026-048: Ironic allows generic node update for maintenance setting
The Metal3.io Security team reported a vulnerability in Ironic’s API. When calling the Node maintenance API at /v1/nodes/{ident}/maintenance , Ironic properly applies the baremetal:node:set_maintenance and baremetal:node:clear_maintenance policies. However, if a user instead calls the more generic Node update API by sending an HTTP PATCH to /v1/nodes/{ident} , and includes maintenance or maintenance_reason in the dictionary, they can instead trigger the baremetal:node:update policy. This may lea
Affected Products
- Ironic: >=17.0.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1
- CVE-2026-89419
References
- https://security.openstack.org/ossa/OSSA-2026-048.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-89419
This unknown severity vulnerability was published on 2026-10-22 via OpenStack. Affected: Ironic: >=17.0.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1, CVE-2026-89419.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.