CVE-2026-90461: OpenStack Ironic Information Disclosure

CVE-2026-90461 Overview

CVE-2026-90461 affects OpenStack Ironic through version 38.0.0. The bare-metal provisioning service may transmit a username and password to an unintended remote host when the Image Service is configured for HTTP or HTTPS Basic Authentication. The flaw is categorized as improper restriction of communication channel to intended endpoints [CWE-923].

An attacker positioned to receive redirected or misrouted image requests can capture credentials intended for a trusted Image Service. This exposes downstream infrastructure to unauthorized access using leaked credentials.

Critical Impact
Basic Authentication credentials configured for the OpenStack Image Service may be leaked to an unexpected remote host, enabling credential theft and lateral movement across bare-metal provisioning infrastructure.

Affected Products

OpenStack Ironic through version 38.0.0
Deployments using Image Service with HTTP Basic Authentication
Deployments using Image Service with HTTPS Basic Authentication

Discovery Timeline

2026-09-11 - CVE-2026-90461 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90461

Vulnerability Analysis

OpenStack Ironic is the bare-metal provisioning component of OpenStack. It retrieves disk images from an Image Service such as Glance to deploy nodes. When operators configure the Image Service endpoint with HTTP or HTTPS Basic Authentication, Ironic attaches an Authorization header containing base64-encoded credentials on outbound image requests.

The vulnerability arises when Ironic follows requests or interacts with a host other than the originally configured Image Service while continuing to send those credentials. The result is credential transmission to an unexpected remote host, matching the [CWE-923] pattern of improper restriction of communication channel to an intended endpoint.

Any party controlling the unintended host receives the Basic Authentication token. That token grants access to the Image Service and any other system reusing those credentials.

Root Cause

The root cause is a failure to restrict credential-bearing requests to the originally trusted endpoint. Ironic does not sufficiently validate that the destination host matches the configured Image Service host before attaching the Authorization header. See the Launchpad Bug Report #2162816 for maintainer discussion.

Attack Vector

Exploitation requires an attacker to influence the destination of an Ironic image request. This may occur through DNS manipulation, a malicious or compromised intermediary, or an unexpected redirect chain returned by an upstream service. Once Ironic sends the request to the attacker-controlled host, the Basic Authentication credentials are captured in plaintext after base64 decoding.

The attack requires low privileges but higher complexity, since the attacker must control or influence the network path or an upstream response. Successful exploitation yields high confidentiality impact through credential disclosure, with scope change extending the impact beyond Ironic itself.

No public exploit code is available for CVE-2026-90461, and no exploitation in the wild has been reported.

Detection Methods for CVE-2026-90461

Indicators of Compromise

Outbound HTTP or HTTPS requests from Ironic conductor hosts to destinations outside the configured Image Service endpoint.
Unexpected Authorization: Basic headers appearing in proxy or egress logs for hosts other than the Image Service.
Redirect chains in Ironic logs where image retrieval terminates on a hostname that differs from the configured Glance or Swift endpoint.

Detection Strategies

Inspect egress traffic from Ironic conductors and compare destination hosts against an allowlist of configured Image Service endpoints.
Enable verbose logging for the Ironic image download subsystem and alert on cross-host redirects during image fetch operations.
Correlate Ironic image request logs with authentication events on the Image Service to identify credential use from unexpected source addresses.

Monitoring Recommendations

Monitor Ironic conductor egress for anomalous destination hostnames or IP addresses during node deployment workflows.
Track failed and successful Basic Authentication attempts against Image Service endpoints to identify credential reuse from unauthorized hosts.
Log and review all HTTP redirect responses processed by the Ironic image client to detect potential redirection to attacker-controlled hosts.

How to Mitigate CVE-2026-90461

Immediate Actions Required

Audit Ironic configurations for use of HTTP or HTTPS Basic Authentication against the Image Service and inventory affected deployments.
Rotate any Basic Authentication credentials that Ironic has used against Image Service endpoints, especially in environments with permissive egress.
Restrict egress from Ironic conductor hosts to only the known Image Service endpoints using firewall or proxy allowlisting.

Patch Information

At time of publication, no fixed version is listed in the NVD entry. Track the upstream fix through the Launchpad Bug Report #2162816 and apply the maintainer-supplied patch once released. Upgrade beyond OpenStack Ironic 38.0.0 when a corrected release is available.

Workarounds

Replace HTTP or HTTPS Basic Authentication with a token-based mechanism such as Keystone-issued tokens where supported by the Image Service.
Terminate Image Service requests at a hardened reverse proxy that enforces destination validation and strips credentials from redirected requests.
Disable automatic redirect following in the Ironic image client configuration where operationally feasible.

bash

# Example egress restriction using iptables on an Ironic conductor host
# Replace 10.0.0.10 with the configured Image Service IP address
iptables -A OUTPUT -p tcp -d 10.0.0.10 --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner ironic -j REJECT