Description (CNA)
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenStack / Ironic | affected 17.0.0 before 29.1.1; affected 30.0.0 before 32.1.1; affected 33.0.0 before 35.1.1; affected 36.0.0 before 39.0.1 |
CWE
CWE-424
References
- https://bugs.launchpad.net/ironic/+bug/2166510
- https://security.openstack.org/ossa/OSSA-2026-048.html
ADP enrichment
No English description supplied.