Approved changes feed: RSS · Atom
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Openstack (7b0cf974-b2b5-592e-bdf4-6953805ef02a) |
|---|---|
| Product | Ironic (d7fc3255-f207-5d72-a6a6-d75dd69242d3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/openstackhelm/ironic |
purl2cpe | 2026-06-01 10:17:03.709796 |
pkg:github/openstack/ironic |
purl2cpe | 2026-06-01 10:17:03.709799 |
pkg:pypi/ironic-python-agent |
purl2cpe | 2026-06-01 10:17:03.709801 |
pkg:rpm/opensuse/openstack-ironic |
purl2cpe | 2026-06-01 10:17:03.709804 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-90461 |
vulnerable | 2026-09-16 04:33:05.248879 |
Details available
MEDIUM (6.3)
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Published: 2026-09-11T21:32:33.740Z
Updated: 2026-09-14T18:17:14.063Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71201 |
vulnerable | 2026-09-16 04:32:59.490109 |
Details available
MEDIUM (5)
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
Published: 2026-08-05T06:19:33.524Z
Updated: 2026-08-05T17:32:05.540Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54423 |
vulnerable | 2026-07-29 01:00:27.807399 |
Details available
HIGH (8.2)
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
Published: 2026-07-10T03:10:54.638Z
Updated: 2026-07-10T15:25:59.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54421 |
vulnerable | 2026-07-29 01:00:27.805828 |
Details available
MEDIUM (6.8)
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
Published: 2026-06-14T03:49:37.996Z
Updated: 2026-06-16T22:38:18.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44918 |
vulnerable | 2026-07-29 00:52:14.918743 |
Details available
MEDIUM (5.5)
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
Published: 2026-07-10T00:00:00.000Z
Updated: 2026-07-10T14:31:59.215Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50589 |
under_investigation | 2026-06-08 08:07:02.837691 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48681 |
vulnerable | 2026-06-08 08:05:12.309633 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44919 |
vulnerable | 2026-06-08 08:05:11.379467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44917 |
vulnerable | 2026-06-08 08:05:11.379193 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44916 |
vulnerable | 2026-06-08 08:05:11.378833 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42997 |
vulnerable | 2026-06-08 08:03:17.003081 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42510 |
vulnerable | 2026-06-08 08:03:16.392327 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-44021 |
vulnerable | 2026-06-08 07:25:10.619849 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.