CVE-2026-54421: 
OpenStack Ironic vulnerability analysis and mitigation

CVE-2026-54421 is an information disclosure vulnerability in OpenStack Ironic that causes sensitive data — such as iSCSI credentials — to be returned unredacted in API responses when a PATCH request is made to update volume properties. It was discovered by Tuomo Tanskanen (Ericsson Software Technology) and Dmitry Tantsur (Red Hat) of the Metal3.io Security Team and publicly disclosed on June 14, 2026, with a formal security advisory (OSSA-2026-023) published on June 16, 2026. Affected versions span >=17.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, and >=36.0.0 <37.0.1; the fixed release is 37.0.1. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory, oss-security).

The root cause is improper removal of sensitive information before transfer (CWE-212) and insertion of sensitive information into sent data (CWE-201): Ironic's API RBAC handling fails to redact sensitive volume target properties (e.g., iSCSI credentials stored in the properties field) when constructing HTTP responses to PATCH requests against the /v1/volume/targets endpoint. The vulnerable code path has existed since Ironic 9.0.0 (OpenStack Pike), but only became an exploitable privilege escalation concern from Ironic 17.0.0 (OpenStack Wallaby) onward, when project-scoped users gained the ability to interact via the owner/lessee model. Notably, POST requests to the same endpoint do not trigger the unredacted disclosure — only PATCH requests are affected. Exploitation requires a valid token and sufficient authorization to send a PATCH request to the volume targets endpoint (oss-security, GitHub Advisory).

A privileged but potentially project-scoped user who is authorized to update volume properties can receive unredacted iSCSI credentials and other sensitive storage authentication data in the API response, data that should be masked. Exposure of iSCSI credentials could allow an attacker to access storage backends directly, potentially leading to unauthorized data access, data exfiltration, or disruption of storage services. There is no integrity or availability impact; the scope is changed because the exposed credentials belong to infrastructure components outside the Ironic API's direct security boundary (GitHub Advisory, oss-security).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.027% (0.000280), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (a valid token with authorization to PATCH volume targets), limiting the attack surface to authenticated users within an OpenStack deployment (GitHub Advisory, Feedly).

1. Authenticate: Obtain a valid OpenStack Keystone token with sufficient privileges (owner or lessee role, or admin) to interact with the Ironic /v1/volume/targets API endpoint.
2. Identify a volume target: Query GET /v1/volume/targets to enumerate existing volume targets associated with a node, noting the UUID of a target that has sensitive properties (e.g., iSCSI credentials) configured.
3. Send a PATCH request: Issue a PATCH request to /v1/volume/targets/{target_uuid} with a valid JSON Patch body updating any authorized field (e.g., changing a non-sensitive property like boot_index).
4. Retrieve unredacted credentials: Inspect the API response body — due to the missing redaction logic, the response will include the full properties object with sensitive fields (e.g., iSCSI username, password, or CHAP secrets) in plaintext rather than masked.
5. Leverage credentials: Use the exposed iSCSI credentials to authenticate directly to the storage backend, enabling unauthorized access to storage volumes (oss-security, GitHub Advisory).

• Logs: Ironic API access logs showing authenticated PATCH requests to /v1/volume/targets/<uuid> from unexpected users or service accounts; repeated PATCH requests to volume target endpoints without corresponding legitimate administrative activity.
• Network: API responses to PATCH /v1/volume/targets containing plaintext credential fields (e.g., properties keys such as auth_username, auth_password, or CHAP-related fields) observable in network captures or API gateway logs.
• Behavioral: Unusual iSCSI login attempts to storage backends from hosts not associated with provisioned bare-metal nodes, potentially indicating use of harvested credentials.

Upgrade OpenStack Ironic to version 37.0.1 or later, which contains the fix for all supported branches (2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and 2026.2/hibiscus). Patches are also available as courtesy backports for unmaintained branches 2024.1/caracal and 2023.1/antelope via the OpenDev review links provided in OSSA-2026-023. As an interim workaround, restrict PATCH access to the /v1/volume/targets endpoint to the minimum set of administrators who require it, and monitor API responses for unintended exposure of sensitive credential fields. Branches 2023.2/bobcat and 2024.2/dalmatian are end-of-life and will not receive patches (oss-security, GitHub Advisory).

The vulnerability was formally announced via the OpenStack Security Advisory (OSSA-2026-023) by Jay Faulkner on the oss-security mailing list on June 16, 2026. Red Hat tracked the issue via Bugzilla (Bug 2488721) and published a corresponding security advisory. Social media activity was limited to automated CVE tracking posts on Bluesky and Mastodon/infosec.exchange. No significant independent researcher commentary or broader media coverage has been identified (oss-security, Red Hat Bugzilla).