CVE-2026-89419
published 2026-10-23CVE-2026-89419: OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…
PriorityP429medium5CVSS 3.1
AVNACHPRLUINSUCLILAL
EPSS
0.29%
21.2th percentile
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-ironic-rhel9 | — | — |
| openstack | ironic | >= 17.0.0 < 29.1.1 | 29.1.1 |
| openstack | ironic | >= 30.0.0 < 32.1.1 | 32.1.1 |
| openstack | ironic | >= 33.0.0 < 35.1.1 | 35.1.1 |
| openstack | ironic | >= 36.0.0 < 39.0.1 | 39.0.1 |
CVSS provenance
nvdv3.15.0MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH
vendor_redhat·2026-10-22·CVSS 5.0
CVE-2026-89419 [MEDIUM] CWE-862 openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH
openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
A flaw was found in OpenStack Ironic. A missing authorization check in the node PATCH API allows an authenticated lessee member to change the maintenance state of a bare metal node, an operation that should be restricted to lessee managers and administrators. By sending a PATCH request to /v1/nodes/{ident} with a maintenance field, the request is processed under the generic node-update policy rather than the stricter set_maintenance policy, bypassing the intended role boundary. This could
GHSA
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
ghsa_unreviewed·2026-10-23
CVE-2026-89419 [MEDIUM] CWE-424 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
No detection rules found.
No public exploits indexed.
2026-10-23
Published