CVE-2026-89419

MediumCVSS 5.0/10Last modified Nov 2, 2026

Description

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-424

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
OpenStack	Ironic	>= 17.0.0, < 29.1.1; >= 30.0.0, < 32.1.1; >= 33.0.0, < 35.1.1; >= 36.0.0, < 39.0.1

References

Timeline

Published: Oct 23, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-89424.3The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is CVE-2026-894207.1Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources w CVE-2026-894229.3Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to imperso CVE-2026-894246.4The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, a CVE-2026-894257.5UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending J CVE-2026-894268.8The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up CVE-2026-894276.1The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in CVE-2026-89434.3The GoStats for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This i CVE-2026-894308.1Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synch CVE-2026-894358.8The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary CVE-2026-894367.8In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] ac CVE-2026-89437In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sar_probe() The me