CVE-2026-54421: OpenStack Ironic sensitive information disclosure in volume target PATCH response

CVE-2026-54421 · Severity: medium · CVSS 6.8 · Published 2026-06-14

OpenStack Ironic is a service that manages bare-metal server provisioning and lifecycle in cloud environments. When users with limited permissions send PATCH requests to update volume properties, the API returns sensitive iSCSI connection credentials (usernames, passwords) in the response that should have been redacted. An attacker with volume update permissions but without credential-viewing permissions can exploit this to obtain storage credentials and connect to volumes outside the normal provisioning workflow, bypassing access controls.

Technologies: OpenStack Ironic, ironic (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-54421 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54421 being exploited in the wild.
How severe is CVE-2026-54421?
Medium severity, with a CVSS score of 6.8, published 14 June 2026.
Which products and versions are affected?
OpenStack Ironic >=17.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1, through 35.0.1; ironic (PyPI) ECOSYSTEM:introduced=17.0.0,fixed=29.0.6, ECOSYSTEM:introduced=17.0.0,fixed=29.0.6,introduced=30.0.0,fixed=32.0.2,introduced=33.0.0,fixed=35.0.2,introduced=36.0.0,fixed=37.0.1.
Is there a fix for CVE-2026-54421?
Yes. ironic (PyPI): upgrade to 29.0.6, 37.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54421 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54421?
Check whether you run OpenStack Ironic or ironic (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ironic (PyPI): upgrade to 29.0.6, 37.0.1 or later
    pip install "ironic>=37.0.1"

Technical details

The vulnerability is an improper removal of sensitive information before transfer (CWE-212) in OpenStack Ironic's volume target API. The root cause is that the `baremetal:volume:view_target_properties` RBAC policy is enforced on GET endpoints but was missing from PATCH and POST write methods in `/v1/volume/targets`. When a PATCH request updates volume target fields, the API response includes the raw `properties` field containing iSCSI credentials without redaction. The attack requires a valid Keystone token with `baremetal:volume:update` or `baremetal:volume:create` permissions but without `view_target_properties` permission. No user interaction, network position beyond API access, or race conditions are needed. Impact is limited to multi-tenant deployments where these permission sets are separated; deployments granting both permissions together are unexploitable. Patches are available in multiple release branches (29.0.6, 32.0.2, 35.0.2, 37.0.1+).

Affected products

  • OpenStack Ironic >=17.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1

Identifiers

  • CVE-2026-54421
  • GHSA-j4cw-mcg2-2q78
  • PYSEC-2026-3852

Timeline

  • 2026-06-14: disclosed: Vulnerability publicly disclosed in GitHub Advisory Database
  • 2026-06-16: other: OpenStack Security Advisory OSSA-2026-023 issued
  • 2026-06-03: patched: Patches merged for development and multiple release branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.