# OpenStack Ironic vulnerabilities Source: https://junglewise.ai/threats/technologies/ironic Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/ironic.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in OpenStack Ironic: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90458, was published on 23 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 4 - All time: 17 (0 critical, 0 exploited in the wild) ## About OpenStack Ironic OpenStack project for bare metal provisioning and lifecycle management of physical servers. ## Latest OpenStack Ironic vulnerabilities - [CVE-2026-90458: OpenStack Ironic path injection in Redfish vendor_passthru](https://junglewise.ai/threats/cve-2026-90458-openstack-ironic-before-39-0-1-allows-delete-and-get-via-vendor) (medium, CVSS 5.4, published 23 Oct 2026) - [CVE-2026-89419: OpenStack Ironic authorization bypass in node maintenance setting](https://junglewise.ai/threats/cve-2026-89419-openstack-ironic-before-39-0-1-sometimes-allows-a-user-to-change) (medium, CVSS 5, published 23 Oct 2026) - [CVE-2026-115638: OpenStack Ironic denial of service via gzip bomb in configdrive](https://junglewise.ai/threats/cve-2026-115638-openstack-ironic-through-39-0-1-allows-a-denial-of-service-via-a) (medium, CVSS 4.3, published 23 Oct 2026) - [CVE-2026-90461: OpenStack Ironic credential leakage in HTTP Basic Authentication](https://junglewise.ai/threats/cve-2026-90461-openstack-ironic-credential-leakage-in-http-basic-authentication) (medium, CVSS 6.3, published 11 Sep 2026) - [CVE-2026-74250: OpenStack Ironic autodetect deploy interface cleaning bypass](https://junglewise.ai/threats/cve-2026-74250-openstack-ironic-autodetect-deploy-interface-cleaning-bypass) (medium, CVSS 6.3, published 14 Aug 2026) - [CVE-2026-54423: OpenStack Ironic RBAC bypass in IPMI raw command execution](https://junglewise.ai/threats/cve-2026-54423-openstack-ironic-rbac-bypass-in-ipmi-raw-command-execution) (high, CVSS 8.2, published 10 Jul 2026) - [CVE-2026-44918: OpenStack Ironic missing authorization in cross-project node operations](https://junglewise.ai/threats/cve-2026-44918-openstack-ironic-missing-authorization-in-cross-project-node) (medium, CVSS 5.5, published 10 Jul 2026) - [CVE-2026-54421: OpenStack Ironic sensitive information disclosure in volume target PATCH response](https://junglewise.ai/threats/cve-2026-54421-openstack-ironic-sensitive-information-disclosure-in-volume) (medium, CVSS 6.8, published 14 Jun 2026) - [CVE-2026-50589: OpenStack Ironic denial of service via crafted JSON in API endpoints](https://junglewise.ai/threats/cve-2026-50589-openstack-ironic-denial-of-service-via-crafted-json-in-api) (medium, CVSS 5.3, published 5 Jun 2026) - [CVE-2026-48681: OpenStack Ironic directory traversal in ISO image extraction](https://junglewise.ai/threats/cve-2026-48681-openstack-ironic-directory-traversal-in-iso-image-extraction) (medium, CVSS 5.9, published 4 Jun 2026) - [CVE-2026-44917: OpenStack Ironic arbitrary file read via pxe_template](https://junglewise.ai/threats/cve-2026-44917-openstack-ironic-arbitrary-file-read-via-pxe-template) (medium, CVSS 4.9, published 4 Jun 2026) - [CVE-2026-46447: OpenStack Ironic boot script injection via unsanitized kernel parameters](https://junglewise.ai/threats/cve-2026-46447-openstack-ironic-boot-script-injection-via-unsanitized-kernel) (medium, CVSS 5.8, published 3 Jun 2026) - [CVE-2026-44919: OpenStack Ironic denial of service via infinite checksum loop](https://junglewise.ai/threats/cve-2026-44919-openstack-ironic-denial-of-service-via-infinite-checksum-loop) (medium, CVSS 4.3, published 14 May 2026) - [CVE-2026-44916: OpenStack Ironic remote code execution in Anaconda deploy interface](https://junglewise.ai/threats/cve-2026-44916-openstack-ironic-remote-code-execution-in-anaconda-deploy) (low, CVSS 3, published 8 May 2026) - [CVE-2026-42997: OpenStack Ironic Credential Forwarding in iDRAC Configuration Molds](https://junglewise.ai/threats/cve-2026-42997-openstack-ironic-credential-forwarding-in-idrac-configuration) (high, CVSS 7.7, published 5 May 2026) - [CVE-2026-43003: OpenStack Ironic Python Agent command injection via malicious image](https://junglewise.ai/threats/cve-2026-43003-openstack-ironic-python-agent-command-injection-via-malicious) (high, CVSS 8, published 1 May 2026) - [CVE-2026-42510: OpenStack Ironic command injection in IPMI console interfaces](https://junglewise.ai/threats/cve-2026-42510-openstack-ironic-command-injection-in-ipmi-console-interfaces) (medium, CVSS 6.6, published 28 Apr 2026) ## Most severe OpenStack Ironic vulnerabilities - [CVE-2026-54423: OpenStack Ironic RBAC bypass in IPMI raw command execution](https://junglewise.ai/threats/cve-2026-54423-openstack-ironic-rbac-bypass-in-ipmi-raw-command-execution) (high, CVSS 8.2, published 10 Jul 2026) - [CVE-2026-43003: OpenStack Ironic Python Agent command injection via malicious image](https://junglewise.ai/threats/cve-2026-43003-openstack-ironic-python-agent-command-injection-via-malicious) (high, CVSS 8, published 1 May 2026) - [CVE-2026-42997: OpenStack Ironic Credential Forwarding in iDRAC Configuration Molds](https://junglewise.ai/threats/cve-2026-42997-openstack-ironic-credential-forwarding-in-idrac-configuration) (high, CVSS 7.7, published 5 May 2026) - [CVE-2026-54421: OpenStack Ironic sensitive information disclosure in volume target PATCH response](https://junglewise.ai/threats/cve-2026-54421-openstack-ironic-sensitive-information-disclosure-in-volume) (medium, CVSS 6.8, published 14 Jun 2026) - [CVE-2026-42510: OpenStack Ironic command injection in IPMI console interfaces](https://junglewise.ai/threats/cve-2026-42510-openstack-ironic-command-injection-in-ipmi-console-interfaces) (medium, CVSS 6.6, published 28 Apr 2026) - [CVE-2026-90461: OpenStack Ironic credential leakage in HTTP Basic Authentication](https://junglewise.ai/threats/cve-2026-90461-openstack-ironic-credential-leakage-in-http-basic-authentication) (medium, CVSS 6.3, published 11 Sep 2026) - [CVE-2026-74250: OpenStack Ironic autodetect deploy interface cleaning bypass](https://junglewise.ai/threats/cve-2026-74250-openstack-ironic-autodetect-deploy-interface-cleaning-bypass) (medium, CVSS 6.3, published 14 Aug 2026) - [CVE-2026-48681: OpenStack Ironic directory traversal in ISO image extraction](https://junglewise.ai/threats/cve-2026-48681-openstack-ironic-directory-traversal-in-iso-image-extraction) (medium, CVSS 5.9, published 4 Jun 2026) - [CVE-2026-46447: OpenStack Ironic boot script injection via unsanitized kernel parameters](https://junglewise.ai/threats/cve-2026-46447-openstack-ironic-boot-script-injection-via-unsanitized-kernel) (medium, CVSS 5.8, published 3 Jun 2026) - [CVE-2026-44918: OpenStack Ironic missing authorization in cross-project node operations](https://junglewise.ai/threats/cve-2026-44918-openstack-ironic-missing-authorization-in-cross-project-node) (medium, CVSS 5.5, published 10 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other OpenStack technologies - [OpenStack Neutron](https://junglewise.ai/threats/technologies/neutron): 5 vulnerabilities - [OpenStack Swift](https://junglewise.ai/threats/technologies/swift): 4 vulnerabilities - [OpenStack Octavia](https://junglewise.ai/threats/technologies/octavia): 3 vulnerabilities - [OpenStack Glance](https://junglewise.ai/threats/technologies/openstack-glance): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenStack Ironic vulnerabilities", https://junglewise.ai/threats/technologies/ironic, 13 November 2026.