Is CVE-2026-90458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90458 being exploited in the wild.

How severe is CVE-2026-90458?

Medium severity, with a CVSS score of 5.4, published 23 October 2026.

Which products and versions are affected?

OpenStack Ironic >=18.1.0 30.0.0 33.0.0 36.0.0 <=39.0.1.

How is CVE-2026-90458 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-90458?

Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90458: OpenStack Ironic path injection in Redfish vendor_passthru

Q: Is there a fix for CVE-2026-90458?

Yes: fixed in Ironic 29.1.2, 32.1.2, 35.1.2, 39.0.2 (and later release series). Until then: Restrict access to the vendor_passthru API endpoint to trusted administrators; sanitize subscription ID inputs to exclude path traversal sequences such as ".." until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-90458 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-90458?

Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90458 · Severity: medium · CVSS 5.4 · Published 2026-10-23

OpenStack Ironic is a service that provisions and manages physical servers through various management interfaces, including Redfish BMCs. A system administrator can exploit improper input validation in the vendor_passthru API to perform unauthorized HTTP DELETE and GET operations on the BMC's Redfish service, potentially deleting user accounts or accessing sensitive endpoint information. Only deployments using Redfish hardware types are affected.

Technologies: OpenStack Ironic. Vendors: OpenStack.

Quick answers

Is CVE-2026-90458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90458 being exploited in the wild.
How severe is CVE-2026-90458?: Medium severity, with a CVSS score of 5.4, published 23 October 2026.
Which products and versions are affected?: OpenStack Ironic >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1.
Is there a fix for CVE-2026-90458?: Yes: fixed in Ironic 29.1.2, 32.1.2, 35.1.2, 39.0.2 (and later release series). Until then: Restrict access to the vendor_passthru API endpoint to trusted administrators; sanitize subscription ID inputs to exclude path traversal sequences such as ".." until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90458 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-90458?: Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Ironic 29.1.2, 32.1.2, 35.1.2, 39.0.2 (and later release series)

Restrict access to the vendor_passthru API endpoint to trusted administrators; sanitize subscription ID inputs to exclude path traversal sequences such as ".." until upgrading.

Technical details

The vulnerability is a path injection flaw in Ironic's Redfish vendor module where operator-controlled subscription IDs are concatenated directly into Redfish resource paths without proper sanitization (only a truthy check is performed). An authenticated System-scoped Administrator can supply traversal payloads (e.g., containing ".." segments) that are collapsed by sushy's URL resolution, allowing arbitrary HTTP operations on BMC endpoints under the cached admin Redfish session. An attacker can delete BMC user accounts, event subscriptions, or other DELETE-capable resources, or leak information via GET operations.

Affected products

OpenStack Ironic >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1

Timeline

2026-09-04: disclosed: Vulnerability reported to OpenStack security team
2026-10-22: advisory: OSSA-2026-047 published
2026-10-23: patched: CVE-2026-90458 assigned and patches merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.