# CVE-2026-89419: OpenStack Ironic authorization bypass in node maintenance setting

Source: https://junglewise.ai/threats/cve-2026-89419-openstack-ironic-before-39-0-1-sometimes-allows-a-user-to-change  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-89419 · Severity: medium · CVSS 5 · Published 2026-10-23

OpenStack Ironic is a service that manages physical server provisioning in cloud infrastructure. A flaw in its API allows lessee project members to change a node's maintenance setting through a generic update endpoint, bypassing the strict permission controls on the dedicated maintenance API. This could allow unauthorized users to take physical servers offline or prevent them from being used.

Technologies: [OpenStack Ironic](https://junglewise.ai/threats/technologies/ironic). Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack).

## Quick answers

**Is CVE-2026-89419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89419 being exploited in the wild.

**How severe is CVE-2026-89419?** Medium severity, with a CVSS score of 5, published 23 October 2026.

**Which products and versions are affected?** OpenStack Ironic 17.0.0 through 39.0.1 (specific branches: >=17.0.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1).

**Is there a fix for CVE-2026-89419?** Yes: fixed in Ironic 39.0.1 and later releases (2024.1/caracal, 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, 2026.2/hibiscus, 2027.1/indri, bugfix/37.0, bugfix/38.0). Until then: Restrict API access to the /v1/nodes endpoint via network policies or API gateway controls to limit which principals can issue PATCH requests to node endpoints until upgrades are applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89419 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-89419?** Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Ironic 39.0.1 and later releases (2024.1/caracal, 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, 2026.2/hibiscus, 2027.1/indri, bugfix/37.0, bugfix/38.0)

Restrict API access to the /v1/nodes endpoint via network policies or API gateway controls to limit which principals can issue PATCH requests to node endpoints until upgrades are applied.

## Technical details

The vulnerability is an authorization bypass in the /v1/nodes/{ident} PATCH endpoint. When maintenance or maintenance_reason fields are included in a PATCH request, the API evaluates the generic baremetal:node:update policy instead of the stricter baremetal:node:set_maintenance and baremetal:node:clear_maintenance policies. An authenticated lessee member (role:member) can exploit this to modify node maintenance state, which normally requires manager or admin privileges. The fix adds explicit policy enforcement for maintenance fields in the generic update endpoint.

## Affected products

- OpenStack Ironic 17.0.0 through 39.0.1 (specific branches: >=17.0.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1)

## Timeline

- 2026-10-22: disclosed
- 2026-10-22: advisory: OSSA-2026-048 published

## References

- [https://bugs.launchpad.net/ironic/+bug/2166510](https://bugs.launchpad.net/ironic/+bug/2166510)
- [https://security.openstack.org/ossa/OSSA-2026-048.html](https://security.openstack.org/ossa/OSSA-2026-048.html)

## Related threats

- [OpenStack Ironic path injection in Redfish vendor_passthru](https://junglewise.ai/threats/cve-2026-90458-openstack-ironic-before-39-0-1-allows-delete-and-get-via-vendor)
- [OpenStack Ironic denial of service via gzip bomb in configdrive](https://junglewise.ai/threats/cve-2026-115638-openstack-ironic-through-39-0-1-allows-a-denial-of-service-via-a)
- [OpenStack Ironic credential leakage in HTTP Basic Authentication](https://junglewise.ai/threats/cve-2026-90461-openstack-ironic-credential-leakage-in-http-basic-authentication)
- [OpenStack Ironic autodetect deploy interface cleaning bypass](https://junglewise.ai/threats/cve-2026-74250-openstack-ironic-autodetect-deploy-interface-cleaning-bypass)
- [OpenStack Ironic RBAC bypass in IPMI raw command execution](https://junglewise.ai/threats/cve-2026-54423-openstack-ironic-rbac-bypass-in-ipmi-raw-command-execution)