CVE-2026-90458 in Ironic
Summary
by MITRE • 10/23/2026
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in OpenStack Ironic prior to version 39.0.1 centers on an insufficient access control mechanism within the vendor passthrough interface. This component is designed to allow cloud operators and automation tools to send arbitrary HTTP requests directly to the Baseboard Management Controller of a bare metal node, facilitating hardware-specific operations that are not covered by standard Ironic APIs. However, in versions before 39.0.1, this mechanism fails to enforce strict authorization checks on specific methods such as DELETE and GET when targeting Redfish services exposed by the BMC. This architectural oversight allows authenticated users with access to the vendor passthrough endpoint to interact directly with underlying hardware management interfaces without adequate validation of their permissions relative to sensitive operations.
From a technical perspective, the flaw lies in the lack of granular permission mapping for HTTP methods directed at specific endpoints within the Redfish service abstraction layer. The BMC typically exposes a RESTful API compliant with the DMTF Redfish standard, which manages critical infrastructure components including user accounts, firmware updates, and power states. By permitting DELETE requests to account-related resources, an attacker or malicious insider can remove administrative users from the BMC's local authentication database. Similarly, GET operations may allow unauthorized enumeration of sensitive configuration data stored on the management controller. This bypasses Ironic’s higher-level role-based access control policies because the vendor passthrough feature was intended for trusted automation workflows but lacks safeguards against misuse by lower-privileged tenants or compromised service accounts.
The operational impact of this vulnerability is severe, as it compromises the integrity and availability of bare metal infrastructure at the hardware management level. An adversary exploiting this flaw can effectively lock out legitimate administrators from managing physical servers by deleting their BMC user accounts, leading to a denial of service for system administration tasks such as remote console access, power cycling, or firmware patching. Furthermore, unauthorized GET requests could expose sensitive network configurations, cryptographic keys, or inventory details stored within the BMC’s Redfish data model. This undermines the isolation guarantees expected in multi-tenant cloud environments where bare metal resources are provisioned to different organizations or projects, potentially leading to cross-project espionage or sabotage of critical infrastructure components.
To mitigate this risk, operators must upgrade OpenStack Ironic to version 39.0.1 or later, which implements stricter access controls for vendor passthrough operations. It is also recommended to review and restrict the permissions assigned to service accounts that utilize the vendor_passthru endpoint, ensuring they adhere to the principle of least privilege. Additionally, organizations should consider implementing network-level segmentation between tenant networks and BMC management interfaces where possible, reducing the attack surface available through API-based exploitation. Regular auditing of access logs for unusual patterns in Redfish interactions can also help detect potential abuse attempts before significant damage occurs.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves a failure to enforce proper authorization levels on specific actions within an application interface. In terms of the MITRE ATT&CK framework, this flaw facilitates lateral movement and impact via T1078 Valid Accounts if used by compromised credentials, or potentially T1499 Endpoint Denial of Service through account deletion. The exploitation vector is primarily remote with low complexity given that it requires only authenticated access to the Ironic API rather than physical proximity or complex exploit chains.