CVE-2026-54421: OpenStack Ironic Information Disclosure

CVE-2026-54421 Overview

CVE-2026-54421 is an information disclosure vulnerability in OpenStack Ironic before version 37.0.1. When an authorized user submits a PATCH request to update fields within volume properties, Ironic returns unredacted sensitive information in the response, including iSCSI credentials. The flaw is tracked under CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer. The equivalent POST operation does not expose this data, isolating the issue to update flows. Authenticated users with high privileges can leverage the response to harvest credentials they would not normally see in cleartext.

Critical Impact
Authenticated PATCH operations against volume properties return unredacted iSCSI credentials, enabling lateral movement against bare-metal storage targets managed by Ironic.

Affected Products

OpenStack Ironic versions prior to 37.0.1
OpenStack deployments exposing the Ironic bare-metal provisioning API
Bare-metal nodes configured with iSCSI volume connection information

Discovery Timeline

2026-06-14 - CVE-2026-54421 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54421

Vulnerability Analysis

OpenStack Ironic manages bare-metal compute nodes and stores connection metadata for attached volumes, including iSCSI initiator credentials. The API normally redacts secret fields when returning volume connector and target objects to clients. The PATCH handler responsible for updating volume property fields fails to apply the same redaction logic before returning the modified object. As a result, the response body contains plaintext secrets that the authorization model expects to remain hidden, even from the requesting user. The POST (creation) path applies redaction correctly and is not affected.

Root Cause

The root cause is improper output sanitization on the update code path [CWE-212]. Ironic's serialization layer enforces redaction for read operations but the PATCH response constructs its payload from the post-update object without routing it through the same masking filter. Sensitive attributes such as iSCSI CHAP usernames and secrets are serialized verbatim. This is a server-side disclosure flaw, not an access control bypass — the requester is authorized to modify the resource but should not receive cleartext secrets in return.

Attack Vector

An authenticated user with permission to update volume properties on a node sends a PATCH request to the Ironic API endpoint for that volume resource. The server processes the update and returns the full object representation, including secret fields that should be redacted. The attacker harvests iSCSI credentials from the response and can then connect directly to the storage target, bypassing Ironic-mediated controls. The vulnerability requires network access to the Ironic API and valid credentials with PATCH authority on volume objects.

No verified exploit code is available for CVE-2026-54421.
Refer to the OpenStack Security Advisory OSSA-2026-023 and the
Launchpad bug report 2155049 for technical details on the affected
PATCH handler and the redaction fix.

Detection Methods for CVE-2026-54421

Indicators of Compromise

Unexpected PATCH requests against /v1/nodes/{node_id}/volume/connectors or /v1/volume/targets endpoints in Ironic API logs.
API responses with HTTP 200 status containing populated connector_id, properties, or CHAP credential fields where redaction markers would be expected.
iSCSI session establishment from hosts that have never previously initiated sessions to the affected storage targets.

Detection Strategies

Audit Ironic API access logs for PATCH operations on volume resources and correlate against the list of users authorized to perform bare-metal provisioning.
Inspect response sizes for volume PATCH operations; unredacted responses are larger than the redacted baseline and can be flagged programmatically.
Monitor authentication events on iSCSI targets for new initiator IQNs or unusual source IP addresses following PATCH activity in Ironic.

Monitoring Recommendations

Forward Ironic API logs and Keystone authentication events to a centralized SIEM for correlation against volume access patterns.
Alert on PATCH-to-POST ratios that deviate from normal operations, since attackers may prefer PATCH to trigger the disclosure.
Track privileged role assignments that grant volume PATCH capability and review them on a recurring cadence.

How to Mitigate CVE-2026-54421

Immediate Actions Required

Upgrade OpenStack Ironic to version 37.0.1 or later, which applies redaction consistently to PATCH response payloads.
Rotate any iSCSI CHAP credentials configured on volume connectors and targets that were updated via PATCH on vulnerable Ironic versions.
Review Ironic role assignments and remove volume PATCH privileges from accounts that do not require them.

Patch Information

The fix is delivered in OpenStack Ironic 37.0.1. Refer to the OpenStack Security Advisory OSSA-2026-023 and the Launchpad Bug Report 2155049 for the upstream patch references. The OpenWall OSS-Security Discussion provides coordinated disclosure context.

Workarounds

Restrict access to the Ironic API to a trusted management network and limit which roles can issue PATCH requests against volume resources.
Where feasible, perform volume property updates by deleting and recreating the resource via POST, which is not affected by the disclosure.
Enforce TLS on the Ironic API and rotate iSCSI credentials regularly to limit the value of any leaked secrets.

bash

# Verify installed Ironic version and upgrade via pip
pip show ironic | grep -i version
pip install --upgrade 'ironic>=37.0.1'

# Restart Ironic services after upgrade
systemctl restart openstack-ironic-api
systemctl restart openstack-ironic-conductor