CVE-2026-89419

Published: Ott 23, 2026 Last Modified: Ott 23, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,0
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low

Description

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

424

Improper Protection of Alternate Path

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity
Applicable Platforms
Technologies: Not Technology-Specific, Web Based
View CWE Details
http://www.openwall.com/lists/oss-security/2026/10/22/7
http://www.openwall.com/lists/oss-security/2026/10/22/7
https://bugs.launchpad.net/ironic/+bug/2166510
https://bugs.launchpad.net/ironic/+bug/2166510
https://security.openstack.org/ossa/OSSA-2026-048.html
https://security.openstack.org/ossa/OSSA-2026-048.html