~ / search / GHSA-j4cw-mcg2-2q78

GHSA-j4cw-mcg2-2q78

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-54421

Packages

EcosystemPackageAffectedFixed in
PyPI ironic >= 17.0.0, < 29.0.6 29.0.6
PyPI ironic >= 30.0.0, < 32.0.2 32.0.2
PyPI ironic >= 33.0.0, < 35.0.2 35.0.2
PyPI ironic >= 36.0.0, < 37.0.1 37.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

References

External links from the advisory. They lead to third-party sites.