CVE-2026-54421
published 2026-06-14CVE-2026-54421: In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted…
PriorityP433medium6.8CVSS 3.1
AVNACLPRHUINSCCHINAN
EPSS
0.29%
21.3th percentile
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | ironic | >= 17.0.0 < 29.0.6 | 29.0.6 |
| openstack | ironic | >= 30.0.0 < 32.0.2 | 32.0.2 |
| openstack | ironic | >= 33.0.0 < 35.0.2 | 35.0.2 |
| openstack | ironic | >= 36.0.0 < 37.0.1 | 37.0.1 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openstack ironic: OpenStack Ironic: Information disclosure via PATCH request on volume properties
vendor_redhat·2026-06-14·CVSS 6.8
CVE-2026-54421 [MEDIUM] CWE-201 openstack ironic: OpenStack Ironic: Information disclosure via PATCH request on volume properties
openstack ironic: OpenStack Ironic: Information disclosure via PATCH request on volume properties
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
A flaw was found in OpenStack Ironic. When an authorized user applies a PATCH operation to update volume properties, the system can inadvertently expose sensitive information, such as iSCSI credentials. This information disclosure vulnerability allows an attacker to gain access to credentials that should remain confidential.
Mitigation: Mitigation for this issue is either not available or the currently availabl
GHSA
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credential
ghsa_unreviewed·2026-06-14
CVE-2026-54421 [MEDIUM] CWE-212 In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credential
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
VulDB
OpenStack Ironic up to 35.0.1 improper removal of sensitive information before storage or transfer (EUVD-2026-36658 / Nessus ID 321075)
vuldb·2026-06-14·CVSS 6.8
CVE-2026-54421 [MEDIUM] OpenStack Ironic up to 35.0.1 improper removal of sensitive information before storage or transfer (EUVD-2026-36658 / Nessus ID 321075)
A vulnerability marked as problematic has been reported in OpenStack Ironic up to 35.0.1. This affects an unknown function. The manipulation leads to improper removal of sensitive information before storage or transfer.
This vulnerability is traded as CVE-2026-54421. It is possible to initiate the attack remotely. There is no exploit available.
Applying a patch is the recommended action to fix this issue.
No detection rules found.
No public exploits indexed.
2026-06-14
Published