Description
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
Published: 2026-06-14
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenStack Ironic versions before 37.0.1 allow an authenticated user to perform a PATCH request on volume properties for which they are authorized, resulting in the return of unredacted sensitive information such as iSCSI credentials. This behavior constitutes a data leak (CWE‑212). The PATCH operation is a security issue, whereas the POST operation on the same resource does not expose sensitive data, indicating the problem is specific to the PATCH path.

Affected Systems

The vulnerability affects OpenStack Ironic releases prior to 37.0.1. Deployments using any of those versions that permit volume property modifications are at risk.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity, while the EPSS score is < 1%, suggesting no current data on exploit probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal or delegated use of a PATCH operation on authorized volume properties, allowing the attacker to retrieve credentials that were intended to remain confidential.

Generated by OpenCVE AI on June 17, 2026 at 22:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch that upgrades Ironic to version 37.0.1 or later, which redacts sensitive data in PATCH responses
  • Restrict PATCH permissions to only users who require access to modify volume properties, minimizing the number of users who can trigger the exposure
  • Audit logs for PATCH requests on volume properties and correlate any anomalous attempts with user activity to detect exploitation attempts

Generated by OpenCVE AI on June 17, 2026 at 22:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 17 Jun 2026 05:15:00 +0000

Type Values Removed Values Added
Title Ironic Unredacted Credentials via Volume Properties PATCH openstack ironic: OpenStack Ironic: Information disclosure via PATCH request on volume properties
Weaknesses CWE-201
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 16 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
Description In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue. In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
References

Mon, 15 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 14 Jun 2026 05:30:00 +0000

Type Values Removed Values Added
Title Ironic Unredacted Credentials via Volume Properties PATCH

Sun, 14 Jun 2026 04:00:00 +0000

Type Values Removed Values Added
Description In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
First Time appeared Openstack
Openstack ironic
Weaknesses CWE-212
CPEs cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack ironic
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Openstack Ironic
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-16T22:38:18.549Z

Reserved: 2026-06-14T03:49:37.600Z

Link: CVE-2026-54421

cve-icon Vulnrichment

Updated: 2026-06-16T22:38:18.549Z

cve-icon NVD

Status : Deferred

Published: 2026-06-14T04:16:30.927

Modified: 2026-06-16T15:51:29.037

Link: CVE-2026-54421

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-14T03:49:37Z

Links: CVE-2026-54421 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-17T22:15:02Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data

  • CWE-212

    Improper Removal of Sensitive Information Before Storage or Transfer