CVE-2026-90458 OpenStack CVE debrief

Who should care

OpenStack Ironic administrators and security teams should assess exposure and prioritize remediation, especially for versions before 39.0.1. They should review the CVE record and OpenStack advisory for details, verify vendor patches, and apply compensating controls if necessary. Security teams should monitor for suspicious activity related to BMC's Redfish service accounts and track exceptions, retest remediated assets, and close the item only after is

Why it matters

CVE-2026-90458 is a medium-severity vulnerability in OpenStack Ironic's vendor_passthru functionality, allowing unauthorized actions on BMC's Redfish service accounts. OpenStack Ironic administrators should assess exposure, prioritize remediation for affected versions, and verify vendor patches.

• Potential unauthorized account deletion from BMC's Redfish service
• Possible exposure of sensitive information via Redfish service
• Need for verification of vendor patches and compensating controls
• Potential disruption of BMC management functionality

Technical summary

OpenStack Ironic before 39.0.1 has a vulnerability in the vendor_passthru functionality, allowing for DELETE and GET requests to the BMC's Redfish service. This could lead to unauthorized account deletion and exposure of sensitive information. The vulnerability has a medium severity and affects OpenStack Ironic deployments, especially those with exposed vendor_passthru functionality. Administrators should assess exposure and prioritize remediation for affected versions, verifying vendor patches and applying compensating controls if necessary.

Defensive priority

Medium priority for OpenStack Ironic deployments, especially those with exposed vendor_passthru functionality.

Recommended defensive actions

• Assess OpenStack Ironic deployments for exposure to vendor_passthru functionality
• Prioritize remediation for versions before 39.0.1
• Verify vendor patches and apply compensating controls if necessary
• Monitor for suspicious activity related to BMC's Redfish service accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and OpenStack advisory provide details on the vulnerability CVE-2026-90458 in OpenStack Ironic versions before 39.0.1. Vendor_passthru functionality allows for unauthorized actions on BMC's Redfish service accounts. The vulnerability has a medium severity and affects OpenStack Ironic deployments, especially those with exposed vendor_passthru functionality. Defenders should verify vendor patches and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.