CVE-2026-90461
published 2026-09-11CVE-2026-90461: OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
PriorityP341medium6.3CVSS 3.1
AVNACHPRLUINSCCHINAN
EPSS
0.36%
28.4th percentile
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | ironic | 24.0.0 – 29.0.6 | — |
| openstack | ironic | 30.0.0 – 32.0.1 | — |
| openstack | ironic | 33.0.0 – 35.0.1 | — |
| openstack | ironic | 36.0.0 – 38.0.0 | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
ghsa_unreviewed·2026-09-12
CVE-2026-90461 [MEDIUM] CWE-923 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Red Hat
ironic: OpenStack Ironic: Information disclosure via unexpected credential transmission
vendor_redhat·2026-09-11·CVSS 6.3
CVE-2026-90461 [MEDIUM] CWE-201 ironic: OpenStack Ironic: Information disclosure via unexpected credential transmission
ironic: OpenStack Ironic: Information disclosure via unexpected credential transmission
A flaw was found in OpenStack Ironic. When the Image Service is configured for HTTP(S) Basic Authentication, Ironic may inadvertently transmit a username and password to an unintended remote host. This could lead to the disclosure of sensitive authentication credentials to an attacker who controls the unexpected host.
No detection rules found.
No public exploits indexed.
2026-09-11
Published