CVE-2026-54421

{"id": "CVE-2026-54421", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54421", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:11:47.109616Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://opendev.org/openstack/ironic", "vendor": "OpenStack", "product": "Ironic", "versions": [{"status": "affected", "version": "17.0.0", "lessThan": "29.0.6", "versionType": "semver"}, {"status": "affected", "version": "30.0.0", "lessThan": "32.0.2", "versionType": "semver"}, {"status": "affected", "version": "33.0.0", "lessThan": "35.0.2", "versionType": "semver"}, {"status": "affected", "version": "36.0.0", "lessThan": "37.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-14T04:16:30.927", "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2155049", "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-023.html", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/16/10", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue."}, {"lang": "es", "value": "En OpenStack Ironic hasta la versi\u00f3n 35.0.1, al aplicar un parche para actualizar campos en las propiedades de volumen para las que el usuario est\u00e1 autorizado, Ironic puede devolver informaci\u00f3n sensible sin redactar (como credenciales iSCSI). El resultado de la operaci\u00f3n PATCH es un problema de seguridad; el resultado de la operaci\u00f3n POST no es un problema de seguridad."}], "lastModified": "2026-07-23T10:10:00.170", "sourceIdentifier": "cve@mitre.org"}