Source: ironic Version: 1:29.0.5-0+deb13u3 Severity: serious Tags: patch security X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at: https://security.openstack.org/ossa/OSSA-2026-047.html Date: October 22, 2026 :CVE: CVE-2026-90458 Affects ~~~~~~~ - Ironic: >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1 Description ~~~~~~~~~~~ The Metal3.io Security team reported a vulnerability in Ironic's API. When calling the ``vendor_passthru`` API endpoint provided by the ``redfish`` management interface to create or delete a subscription, a malicious System-scoped Administrator could instead perform an HTTP DELETE or HTTP GET on an arbitrary path on a node's BMC. In a worst case scenario, this could lead to user accounts being deleted from the Redfish service on the BMC. Only clouds with nodes enrolled in a redfish hardware type are susceptible to this vulnerability. Patches ~~~~~~~ - https://review.opendev.org/1011870 (2024.1/caracal (unmaintained)) - https://review.opendev.org/1011868 (2025.1/epoxy) - https://review.opendev.org/1011866 (2025.2/flamingo) - https://review.opendev.org/1011864 (2026.1/gazpacho) - https://review.opendev.org/1011862 (2026.2/hibiscus) - https://review.opendev.org/1011860 (2027.1/indri (development)) - https://review.opendev.org/1011874 (Bugfix/37.0) - https://review.opendev.org/1011872 (Bugfix/38.0) Credits ~~~~~~~ - Tuomo Tanskanen, Metal3.io Security Team from Ericsson Software Technology (CVE-2026-90458) - Dmitry Tantsur, Metal3.io Security Team from Red Hat (CVE-2026-90458) References ~~~~~~~~~~ - https://launchpad.net/bugs/2166507 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90458 Notes ~~~~~ - Patches for unmaintained/2024.1, bugfix/38.0 and bugfix/37.0 will be merged to git but no new release will be provided.
