PYSEC-2026-3852

    Dashboard / Vulnerabilities / PYSEC-2026-3852

    PYSEC-2026-3852

    Published: 10 Sept 2026Last Modified: 10 Sept 2026

    Summary: OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

    Details: In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

    References: https://nvd.nist.gov/vuln/detail/CVE-2026-54421, https://github.com/openstack/ironic/commit/dd2df520fe0ae019cb247a8295542abc2d4b46dd, https://bugs.launchpad.net/ironic/+bug/2155049, https://github.com/openstack/ironic, https://review.opendev.org/c/openstack/ironic/+/990430, https://security.openstack.org/ossa/OSSA-2026-023.html, http://www.openwall.com/lists/oss-security/2026/06/16/10, https://pypi.org/project/ironic, https://github.com/advisories/GHSA-j4cw-mcg2-2q78

    Affected packages

    Package

    Name: ironic

    Purl: pkg:pypi/ironic

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 17.0.0
    Fixed -29.0.6

    Affected versions

    17.0.0
    17.0.1
    17.0.2
    17.0.3
    17.0.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2026-3852 | CVE-DB