{}

{}

{}

{"acknowledgement": "Upstream acknowledges Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) as the original reporters.", "bugzilla": {"description": "openstack-ironic: openstack-ironic: Redfish vendor_passthru subscription id path traversal", "id": "2548612", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548612"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["A path traversal vulnerability was found in OpenStack Ironic Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges could use a crafted subscription id to access or delete arbitrary Redfish resources on a node's BMC."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."}, "name": "CVE-2026-90458", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-10-22T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-90458\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-90458\nhttps://bugs.launchpad.net/ironic/+bug/2166507"], "statement": "This flaw is rated Moderate based on CVSS scoring with high privileges required by default. The vendor passthrough API is gated by the baremetal:node:vendor_passthru policy, which defaults to system-scoped administrator access. Exploitation is confined to the BMC Redfish management plane. Red Hat product impact analysis is in progress for products that ship openstack-ironic.", "threat_severity": "Moderate"}

{}