Live › vulnerability › CVE-2026-89419
Go to dashboardOpenStack Ironic before 39.0.1 sometimes lets a user set a node's maintenance mode through a PATCH to /v1/nodes/{ident} instead of the dedicated maintenance endpoint. An attacker with a user account can toggle maintenance on a bare-metal node, which bypasses the access control intended for that action.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running OpenStack Ironic before 39.0.1 where non-admin users have API access to nodes. Deployments where only administrators can reach the Ironic API can deprioritise this.
No product ranges from the sources yet.
ironic-api --version or pip show ironic on the API host, and compare it to 39.0.139.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-89419")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.