CVE-2026-54421

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-14 · updated 2026-07-23
Weakness: CWE-212

Description

In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

Affected products

OpenStack Ironic: from 17.0.0 before 29.0.6; from 30.0.0 before 32.0.2; from 33.0.0 before 35.0.2; from 36.0.0 before 37.0.1 — fixed in 29.0.6, 32.0.2, 35.0.2, 37.0.1

How to fix

Upgrade to a fixed version: OpenStack Ironic 29.0.6, 32.0.2, 35.0.2, 37.0.1. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/ironic/+bug/2155049
https://security.openstack.org/ossa/OSSA-2026-023.html
http://www.openwall.com/lists/oss-security/2026/06/16/10

Get alerted when CVE-2026-54421 or the next vulnerability affects your stack