PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90461 OpenStack CVE debrief

OpenStack Ironic may send authentication credentials to an unexpected remote host when configured for HTTP(S) Basic Authentication with Image Service. This vulnerability affects OpenStack Ironic deployments using Image Service with HTTP(S) Basic Authentication. The issue may lead to potential credential leaks and unexpected remote host access. OpenStack administrators and security teams should assess exposure and verify Image Service configuration to prevent potential credential leaks and unexpected remote host access.

Vendor
OpenStack
Product
Ironic
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-22
Advisory published
2026-09-11
Advisory updated
2026-09-22

Who should care

OpenStack administrators and security teams should assess exposure and verify Image Service configuration to prevent potential credential leaks and unexpected remote host access. This includes reviewing current deployments, identifying potential vulnerabilities, and implementing necessary mitigations to secure affected systems. Security teams should also monitor for suspicious activity and review compensating and 3

Why it matters

OpenStack Ironic may send authentication credentials to an unexpected remote host when configured for HTTP(S) Basic Authentication with Image Service. OpenStack administrators and security teams should assess exposure and verify Image Service configuration to prevent potential credential leaks and unexpected remote host access.

  • Potential authentication credential leak
  • Unexpected remote host access may occur
  • Verify Image Service configuration to prevent exposure

Technical summary

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. This occurs due to the insecure transmission of authentication credentials. Affected deployments should verify Image Service configuration and restrict access to trusted hosts to mitigate potential credential leaks.

Defensive priority

Verify Image Service configuration and restrict access to trusted hosts.

Recommended defensive actions

  • Verify Image Service configuration for HTTP(S) Basic Authentication
  • Restrict access to trusted hosts
  • Monitor for suspicious activity

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90461 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90461

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90461 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90461

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.