CVE-2026-54421 OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
An attacker can retrieve unredacted sensitive information, such as iSCSI credentials, by sending a PATCH request to update volume properties in OpenStack Ironic.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54421?
CVE-2026-54421 is a medium-severity vulnerability in OpenStack Ironic, published on 14 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
Weakness: CWE-212
Which versions are affected by CVE-2026-54421?
9 open source packages ship an affected version, including ironic.
| Package | Affected | Fixed in |
|---|---|---|
ironic PyPI | From 17.0.0 | 29.0.6, 32.0.2, 35.0.2, 37.0.1 |
ironic PyPI | From 17.0.0 | 29.0.6 |
ironic PyPI | From 17.0.0 | 29.0.6 |
ironic PyPI | From 30.0.0 | 32.0.2 |
ironic PyPI | From 30.0.0 | 32.0.2 |
ironic PyPI | From 33.0.0 | 35.0.2 |
3 more packages
ironic PyPI | From 33.0.0 | 35.0.2 |
ironic PyPI | From 36.0.0 | 37.0.1 |
ironic PyPI | From 36.0.0 | 37.0.1 |
How do I fix CVE-2026-54421?
Upgrade ironic to a fixed version for your release line: 29.0.6, 32.0.2, 35.0.2 or 37.0.1.
Is CVE-2026-54421 being exploited?
There is no known exploitation of CVE-2026-54421 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-54421, GHSA-j4cw-mcg2-2q78, PYSEC-2026-3852, UBUNTU-CVE-2026-54421.