CVE-2026-54421: OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

June 14, 2026 (updated August 25, 2026)

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

References

bugs.launchpad.net/ironic/+bug/2155049
github.com/advisories/GHSA-j4cw-mcg2-2q78
github.com/openstack/ironic/commit/dd2df520fe0ae019cb247a8295542abc2d4b46dd
nvd.nist.gov/vuln/detail/CVE-2026-54421
review.opendev.org/c/openstack/ironic/+/990430
security.openstack.org/ossa/OSSA-2026-023.html

Code Behaviors & Features

Detect and mitigate CVE-2026-54421 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →