CVE-2026-90461: Openstack Ironic

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

Affected products

• Openstack Ironic: from 24.0.0, up to and including 29.0.6; from 30.0.0, up to and including 32.0.1; from 33.0.0, up to and including 35.0.1; from 36.0.0, up to and including 38.0.0

Published 2026-09-11. Last modified 2026-10-09.