CVE-2026-90458: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-90458 is a path traversal vulnerability in OpenStack Ironic's Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges can supply a crafted subscription ID to access or delete arbitrary Redfish resources on a node's Baseboard Management Controller (BMC). The vulnerability was reported on October 9, 2026, and publicly disclosed (unembargoed) on October 22, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium), though the severity category is estimated as High (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 — Path Traversal). Specifically, the get_subscription and delete_subscription functions in ironic/drivers/modules/redfish/vendor.py concatenate an operator-supplied subscription ID directly into the BMC Redfish URL path without blocking traversal sequences. The Sushy library's URL resolution then allows the crafted path to escape the EventService/Subscriptions scope and issue GET or DELETE requests against arbitrary Redfish resources using the conductor's BMC-admin session. Exploitation requires an authenticated account with the baremetal:node:vendor_passthru policy privilege, which defaults to SYSTEM_ADMIN (Red Hat Bugzilla).

A successful exploit allows an authenticated attacker with vendor passthrough privileges to read or delete arbitrary Redfish resources on a node's BMC, bypassing the intended EventService/Subscriptions scope restriction. This can result in unauthorized disclosure of BMC configuration data (confidentiality impact), deletion or modification of Redfish resources such as event subscriptions or power management settings (integrity impact), and potential disruption of BMC-managed hardware functions (availability impact). Because the conductor's BMC-admin session is used, the attacker effectively operates with elevated BMC-level access beyond their intended scope (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The CVE status remains "Reserved" and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement for an authenticated account with SYSTEM_ADMIN-level vendor passthrough privileges, which significantly limits the attacker pool. No EPSS score or threat actor attribution is currently available (Red Hat CVE, Red Hat Bugzilla).

1. Obtain Privileges: Acquire an OpenStack account with the baremetal:node:vendor_passthru policy privilege (default: SYSTEM_ADMIN) on a deployment running a vulnerable version of OpenStack Ironic.
2. Identify Target Node: Enumerate available Ironic nodes and identify one with a Redfish-capable BMC accessible through the Ironic conductor.
3. Craft Malicious Subscription ID: Construct a subscription ID containing path traversal sequences (e.g., ../../SomeOtherRedfishResource) designed to escape the EventService/Subscriptions path scope when concatenated into the BMC Redfish URL.
4. Invoke Vendor Passthrough: Send a GET or DELETE vendor passthrough request to the Ironic API targeting the get_subscription or delete_subscription endpoint, supplying the crafted subscription ID as the parameter.
5. Access/Delete Arbitrary Resources: The Ironic conductor, using its BMC-admin session, resolves the traversed URL and issues the corresponding Redfish GET or DELETE request against the unintended BMC resource, returning data or deleting the resource on behalf of the attacker (Red Hat Bugzilla).

• Logs: Ironic conductor logs showing vendor passthrough requests to get_subscription or delete_subscription with subscription IDs containing ../ or URL-encoded traversal sequences (e.g., %2e%2e%2f).
• Network: Unexpected Redfish GET or DELETE requests from the Ironic conductor to BMC endpoints outside the EventService/Subscriptions path hierarchy.
• Logs: Audit logs recording baremetal:node:vendor_passthru API calls from accounts not typically performing subscription management operations.
• BMC: Unexplained deletion or modification of Redfish resources (e.g., power settings, event subscriptions, user accounts) on managed nodes' BMCs.

Apply available patches from Red Hat for the openstack-ironic package as referenced in the Red Hat Bugzilla entry and upstream Launchpad bug (https://bugs.launchpad.net/ironic/+bug/2166507). As a workaround, restrict the baremetal:node:vendor_passthru policy to only fully trusted administrators, minimizing the number of accounts that can invoke vendor passthrough operations. Additionally, monitor Ironic conductor logs and BMC audit trails for subscription management requests containing path traversal patterns, and consider implementing network-level controls to restrict BMC access to only the Ironic conductor (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was disclosed via the oss-security mailing list on October 22, 2026, and tracked through Red Hat's security response process with 23 CC'd users including OpenStack and Red Hat product security team members. No notable public researcher commentary or broad media coverage has been identified beyond the initial disclosure (Red Hat Bugzilla).