CVE-2026-90458

MediumCVSS 5.4/10Last modified Oct 29, 2026

Description

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
OpenStackIronic>= 18.1.0, < 29.1.1; >= 30.0.0, < 32.1.1; >= 33.0.0, < 35.1.1; >= 36.0.0, < 39.0.1

References

Timeline

Published
Oct 23, 2026
Last modified
Oct 29, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-90467.0A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusCVE-2026-904607.6An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, applicatCVE-2026-904616.3OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) BCVE-2026-904625.4A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-opeCVE-2026-904634.0A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted servicCVE-2026-904647.2An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attackCVE-2026-904659.4A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such asCVE-2026-904666.5Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix maCVE-2026-904674.0aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MCVE-2026-90477.6Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knCVE-2026-904725.3msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays anCVE-2026-904735.3msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with
CVE-2026-90458: Medium severity, CVSS 5.4 | Vulnix