{"id":"CVE-2026-90458","aliases":[],"cve":{"records":[{"id":"CVE-2026-90458","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-11T21:01:13.236Z","published":"2026-10-23T03:50:48.611Z","modified":"2026-10-29T12:46:14.679Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-10-23T03:50:48.611Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-23T04:13:17.252Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T12:46:14.679Z"}],"references":[{"url":"https://bugs.launchpad.net/ironic/+bug/2166507","tags":[],"source":"mitre"},{"url":"https://security.openstack.org/ossa/OSSA-2026-047.html","tags":[],"source":"mitre"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/6","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-1287","description":"CWE-1287 Improper Validation of Specified Type of Input","source":"mitre"}],"applicability":[{"source":"mitre","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*","versionStartIncluding":"18.1.0","versionEndExcluding":"29.1.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*","versionStartIncluding":"30.0.0","versionEndExcluding":"32.1.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*","versionStartIncluding":"33.0.0","versionEndExcluding":"35.1.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*","versionStartIncluding":"36.0.0","versionEndExcluding":"39.0.1"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T12:45:59.632113Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.","titleSource":"mitre","descriptionSource":"mitre","description":"OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.","score":5.4,"severity":"medium","published":"2026-10-23T03:50:48.611Z","modified":"2026-10-29T12:46:14.679Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"OpenStack","name":"Ironic","platforms":[],"versions":[{"version":"18.1.0","status":"affected","lessThan":"29.1.1","versionType":"semver"},{"version":"30.0.0","status":"affected","lessThan":"32.1.1","versionType":"semver"},{"version":"33.0.0","status":"affected","lessThan":"35.1.1","versionType":"semver"},{"version":"36.0.0","status":"affected","lessThan":"39.0.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-90458"}],"remediation":[],"references":["https://bugs.launchpad.net/ironic/+bug/2166507","https://security.openstack.org/ossa/OSSA-2026-047.html","http://www.openwall.com/lists/oss-security/2026/10/22/6"],"sources":[{"name":"CVE","id":"CVE-2026-90458","modified":"2026-10-29T12:46:14.679Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-90458"}],"assessments":[{"source":"mitre","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4}],"sourceAffected":[],"observedAt":"2026-10-29T14:48:08.226Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:00:34.533Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T13:05:35.192Z","attemptedAt":"2026-10-29T13:05:35.192Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T13:05:35.092Z","attemptedAt":"2026-10-29T13:05:35.092Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T13:05:36.065Z","attemptedAt":"2026-10-29T13:05:36.065Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T13:05:34.663Z","attemptedAt":"2026-10-29T13:05:34.663Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-90458","url":"https://www.first.org/epss/","probability":0.00277,"percentile":0.20112,"date":"2026-10-28","checkedAt":"2026-10-29T13:05:34.663Z"},{"source":"GitHub Advisory Database","id":"GHSA-54m8-h3qj-96qg","url":"https://github.com/advisories/GHSA-54m8-h3qj-96qg","modified":"2026-10-23T06:31:32Z","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-29T13:05:35.092Z"},{"source":"NVD","id":"CVE-2026-90458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90458","modified":"2026-10-23T19:43:46.190","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-29T13:05:35.192Z"},{"source":"ENISA EUVD","id":"EUVD-2026-108574","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108574","modified":"Oct 29, 2026, 12:46:14 PM","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-29T13:05:36.065Z"}],"aiSummary":{"text":"OpenStack Ironic before 39.0.1 allows unauthorized DELETE and GET requests via vendor_passthru, potentially affecting the BMC's Redfish service. Affected versions include 18.1.0 to 29.1.1, 30.0.0 to 32.1.1, 33.0.0 to 35.1.1, and 36.0.0 to 39.0.1. The weakness is due to improper validation of input.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:18:14.308Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-90458"}]}}