UNKNOWN OpenStack
CVE-2026-90458
OSSA-2026-047: Redfish vendor_passthru method allows path injection via ID
The Metal3.io Security team reported a vulnerability in Ironic’s API. When calling the vendor_passthru API endpoint provided by the redfish management interface to create or delete a subscription, a malicious System-scoped Administrator could instead perform an HTTP DELETE or HTTP GET on an arbitrary path on a node’s BMC. In a worst case scenario, this could lead to user accounts being deleted from the Redfish service on the BMC. Only clouds with nodes enrolled in a redfish hardware type are sus
Affected Products
- Ironic: >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1
- CVE-2026-90458
References
- https://security.openstack.org/ossa/OSSA-2026-047.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-90458
This unknown severity vulnerability was published on 2026-10-22 via OpenStack. Affected: Ironic: >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1, CVE-2026-90458.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.