OSSA-2026-023: Sensitive properties returned unredacted in POST and PATCH HTTP responses

Date:

June 16, 2026

CVE:

CVE-2026-54421

Affects

• Ironic: >=17.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1

Description

Tuomo Tanskanen (Ericsson Software Technology) and Dmitry Tantsur (Red Hat) of the Metal3.io Security Team discovered a vulnerability in Ironic API RBAC handling, where a user with a valid token and credentials to send a POST or PATCH request to /v1/volume/targets can have potentially sensitive properties returned in the response unredacted, such as iSCSI credentials.

Patches

• https://review.opendev.org/c/openstack/ironic/+/992335 (2023.1/antelope (unmaintained))

• https://review.opendev.org/c/openstack/ironic/+/992333 (2024.1/caracal (unmaintained))

• https://review.opendev.org/c/openstack/ironic/+/992326 (2025.1/epoxy)

• https://review.opendev.org/c/openstack/ironic/+/992325 (2025.2/flamingo)

• https://review.opendev.org/c/openstack/ironic/+/992321 (2026.1/gazpacho)

• https://review.opendev.org/c/openstack/ironic/+/990430 (2026.2/hibiscus (development))

• https://review.opendev.org/c/openstack/ironic/+/992323 (Bugfix/33.0)

• https://review.opendev.org/c/openstack/ironic/+/992322 (Bugfix/34.0)

Credits

• Tuomo Tanskanen from Ericsson Software Technology

• Dmitry Tantsur from Red Hat

References

• https://bugs.launchpad.net/ironic/+bug/2155049

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54421

Notes

• The vulnerable code path has existed since Ironic 9.0.0 (OpenStack Pike), however, this could only be considered an escalation of privileges after Ironic 17.0.0 (OpenStack Wallaby), when Ironic introduced the ability for project-scoped users to interact via the owner/lessee model.

• Branches for 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmatian) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases.

• Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.