#1151656 CVE-2026-90458 / OSSA-2026-047: Redfish vendor_passthru method allows path injection via ID

Package:
src:ironic
Source:
src:ironic
Submitter:
Thomas Goirand
Date:
2026-10-22 18:23:01 UTC
Severity:
normal
Tags:
#1151656#5
Date:
2026-10-22 17:12:34 UTC
From:
To:
As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-047.html

Date: October 22, 2026
:CVE: CVE-2026-90458


Affects
~~~~~~~
- Ironic: >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1


Description
~~~~~~~~~~~
The Metal3.io Security team reported a vulnerability in Ironic's API.
When calling the ``vendor_passthru`` API endpoint provided by the
``redfish`` management interface to create or delete a subscription,
a malicious System-scoped Administrator could instead perform an HTTP
DELETE or HTTP GET on an arbitrary path on a node's BMC. In a worst
case scenario, this could lead to user accounts being deleted from
the Redfish service on the BMC.

Only clouds with nodes enrolled in a redfish hardware type are
susceptible to this vulnerability.



Patches
~~~~~~~
- https://review.opendev.org/1011870 (2024.1/caracal (unmaintained))
- https://review.opendev.org/1011868 (2025.1/epoxy)
- https://review.opendev.org/1011866 (2025.2/flamingo)
- https://review.opendev.org/1011864 (2026.1/gazpacho)
- https://review.opendev.org/1011862 (2026.2/hibiscus)
- https://review.opendev.org/1011860 (2027.1/indri (development))
- https://review.opendev.org/1011874 (Bugfix/37.0)
- https://review.opendev.org/1011872 (Bugfix/38.0)


Credits
~~~~~~~
- Tuomo Tanskanen, Metal3.io Security Team from Ericsson Software Technology (CVE-2026-90458)
- Dmitry Tantsur, Metal3.io Security Team from Red Hat (CVE-2026-90458)


References
~~~~~~~~~~
- https://launchpad.net/bugs/2166507
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90458


Notes
~~~~~
- Patches for unmaintained/2024.1, bugfix/38.0 and bugfix/37.0 will be
  merged to git but no new release will be provided.