CVE-2026-90461

OpenStack / Ironic PUBLISHED

Description (CNA)

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

Affected (CNA)

Vendor / product	Versions
OpenStack / Ironic	affected 24.0.0 through 29.0.6; affected 30.0.0 through 32.0.1; affected 33.0.0 through 35.0.1; affected 36.0.0 through 38.0.0

CWE

CWE-923

References

https://bugs.launchpad.net/ironic/+bug/2162816

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/09/2