Live › vulnerability › CVE-2026-90458
Go to dashboardOpenStack Ironic before 39.0.1 exposes DELETE and GET methods through vendor_passthru, which can be used to act on the BMC. An attacker who can reach that API can delete accounts on the BMC's Redfish service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running OpenStack Ironic for bare-metal provisioning with vendor drivers that use vendor_passthru and Redfish-managed BMCs. Deployments that do not run Ironic, or that keep the API and BMC networks isolated, face much less exposure.
No product ranges from the sources yet.
openstack baremetal driver list or the ironic-api package version; versions below 39.0.1 are affected.39.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
This page as .md · .json · in your agent: get_signal("CVE-2026-90458")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.