CVE-2026-50589 OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

What is CVE-2026-50589?

CVE-2026-50589 is a medium-severity unsafe deserialization vulnerability in OpenStack Ironic, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

Weakness: CWE-502, CWE-770

Which versions are affected by CVE-2026-50589?

3 open source packages ship an affected version, including ironic. It affects 1 product.

Products include Openstack Ironic.

How do I fix CVE-2026-50589?

Upgrade ironic to 37.0.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-50589 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50589 exists.

Other vulnerabilities in OpenStack Ironic

• CVE-2026-42997 OpenStack Ironic has an Incorrect Resource Transfer Between Spheres High 7.7
• CVE-2026-42510 OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere Medium 6.6
• CVE-2015-7514 Information disclosure in n/a Medium 6.5
• CVE-2026-48681 OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image Medium 5.9
• CVE-2026-46447 OpenStack Ironic allows Boot Script Injection Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-50589, GHSA-q3g8-rjrx-59ph, PYSEC-2026-216, UBUNTU-CVE-2026-50589.