CVE-2026-54421

In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://bugs.launchpad.net/ironic/+bug/2155049
https://security.openstack.org/ossa/OSSA-2026-023.html
http://www.openwall.com/lists/oss-security/2026/06/16/10

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-14 04:16

Updated : 2026-07-23 10:10

NVD link : CVE-2026-54421

Mitre link : CVE-2026-54421

CVE.ORG link : CVE-2026-54421

JSON object : View

Products Affected

No product.

CWE

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

{"id": "CVE-2026-54421", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54421", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:11:47.109616Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://opendev.org/openstack/ironic", "vendor": "OpenStack", "product": "Ironic", "versions": [{"status": "affected", "version": "17.0.0", "lessThan": "29.0.6", "versionType": "semver"}, {"status": "affected", "version": "30.0.0", "lessThan": "32.0.2", "versionType": "semver"}, {"status": "affected", "version": "33.0.0", "lessThan": "35.0.2", "versionType": "semver"}, {"status": "affected", "version": "36.0.0", "lessThan": "37.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-14T04:16:30.927", "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2155049", "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-023.html", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/16/10", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue."}, {"lang": "es", "value": "En OpenStack Ironic hasta la versi\u00f3n 35.0.1, al aplicar un parche para actualizar campos en las propiedades de volumen para las que el usuario est\u00e1 autorizado, Ironic puede devolver informaci\u00f3n sensible sin redactar (como credenciales iSCSI). El resultado de la operaci\u00f3n PATCH es un problema de seguridad; el resultado de la operaci\u00f3n POST no es un problema de seguridad."}], "lastModified": "2026-07-23T10:10:00.170", "sourceIdentifier": "cve@mitre.org"}