{"id":"CVE-2026-89419","kind":"vulnerability","aliases":["CVE-2026-89419"],"related":[],"title":"OpenStack Ironic: users can change node maintenance flag via PATCH","description":"OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.","summary":"OpenStack Ironic before 39.0.1 sometimes lets a user set a node's maintenance mode through a PATCH to /v1/nodes/{ident} instead of the dedicated maintenance endpoint. An attacker with a user account can toggle maintenance on a bare-metal node, which bypasses the access control intended for that action.","severity":"medium","cvss":5.0,"epss":0.00288,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bare-metal","infrastructure","ironic","openstack","self-hosted"],"not_affected_if":["admin-only-api-access"],"how_to_check":"- Check the installed Ironic version with `ironic-api --version` or `pip show ironic` on the API host, and compare it to `39.0.1`\n- Review who holds user roles on Ironic nodes, since the flaw needs an authenticated account","fix":"- Upgrade OpenStack Ironic to `39.0.1` or later\n- Until upgraded, restrict PATCH access to /v1/nodes/{ident} to trusted admin roles","status":"open","published_at":"2026-10-23T04:18:19+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:29:21+00:00","updated_at":"2026-10-25T04:29:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenStack Ironic to `39.0.1` or later\n- Until upgraded, restrict PATCH access to /v1/nodes/{ident} to trusted admin roles","reach":"network","title":"OpenStack Ironic: users can change node maintenance flag via PATCH","impact":"low","summary":"OpenStack Ironic before 39.0.1 sometimes lets a user set a node's maintenance mode through a PATCH to /v1/nodes/{ident} instead of the dedicated maintenance endpoint. An attacker with a user account can toggle maintenance on a bare-metal node, which bypasses the access control intended for that action.","category":"infrastructure","nicknames":[],"who_cares":["openstack","ironic","bare-metal","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user changes node maintenance state, bypassing intended endpoint controls","analyst_note":"","how_to_check":"- Check the installed Ironic version with `ironic-api --version` or `pip show ironic` on the API host, and compare it to `39.0.1`\n- Review who holds user roles on Ironic nodes, since the flaw needs an authenticated account","needs_analyst":false,"not_affected_if":["admin-only-api-access"],"who_is_affected":"Operators running OpenStack Ironic before 39.0.1 where non-admin users have API access to nodes. Deployments where only administrators can reach the Ironic API can deprioritise this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3338,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-89419':13A,16A '/v1/nodes':44B,95C '39.0.1':29B,79C 'access':70B 'account':57B 'action':75B 'allow':81C 'attack':53B 'bare':18B,64B 'bare-met':17B,63B 'bypass':68B 'chang':5A,85C 'control':71B 'cve':11A,14A 'dedic':49B 'endpoint':51B,105C 'flag':8A 'host':25B 'ident':45B,96C 'infrastructur':20B 'instead':46B 'intend':72B 'iron':2A,21B,27B,77C 'let':31B 'mainten':7A,38B,50B,60B,87C,104C 'metal':19B,65B 'mode':39B 'node':6A,36B,66B,91C 'openstack':1A,22B,26B,76C 'patch':10A,42B,93C 'self':24B 'self-host':23B 'set':34B,88C 'sometim':30B,80C 'specif':103C 'toggl':59B 'use':101C 'user':3A,33B,56B,83C 'via':9A,92C 'word':99C","nicknames":[],"mitigations":[],"who_affected":"Operators running OpenStack Ironic before 39.0.1 where non-admin users have API access to nodes. Deployments where only administrators can reach the Ironic API can deprioritise this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T04:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89419","severity":null,"published_at":"2026-10-23T04:18:19+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89419","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89419","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}