354 matches found
EUVD-2026-76751
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
Linux Distros Unpatched Vulnerability : CVE-2026-90461
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
A flaw was found in OpenStack Ironic. When the Image Service is configured for HTTPS Basic Authentication, Ironic may inadvertently transmit a username and password to an unintended remote host. This could lead to the disclosure of sensitive authentication credentials to an attacker who controls...
DEBIAN-CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
UBUNTU-CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461
OpenStack Ironic versions through 38.0.0 may leak a username and password to an unexpected remote host when the Image Service is configured for HTTP(S) Basic Authentication . The credential disclosure results in a HIGH confidentiality impact with a changed scope , rated CVSS 3.1: 6.3 (Medium) due...
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
CVE-2026-90461: Improper Restriction of Communication Channel to Intended Endpoints
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication...
PT-2026-90517
CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication. https://t.co/ar9eeuKgWS...
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...
PYSEC-2026-3852 OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...
CVE-2026-71201
A flaw was found in OpenStack Ironic. A project reader can exploit this vulnerability by sending a specially crafted request to the Ironic service. This allows the reader to access Portgroups that are assigned to Nodes belonging to or leased by other projects, leading to unauthorized information...
CVE-2026-74250
A flaw was found in OpenStack Ironic. The autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. This can lead to operational issues where necessary cleaning procedures are not executed. Mitigation Use an explicit...
EUVD-2026-58824
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface...
Linux Distros Unpatched Vulnerability : CVE-2026-74250
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect...