CVE-2026-50589: OpenStack Ironic Unauthenticated Denial of Service (MEDIUM, 5.3)

Technical summary

CVE-2026-50589 is a denial-of-service vulnerability in OpenStack Ironic resulting from insufficient input validation on JSON payloads. The flaw resides in deserialization logic affecting both REST API and JSON-RPC endpoints, allowing unauthenticated remote attackers to trigger unhandled exceptions and crash the service. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that crafted JSON can trigger resource exhaustion or unsafe deserialization paths.

Business impact

Interruption of the Ironic bare-metal provisioning service will disrupt infrastructure orchestration and hardware lifecycle management operations. Organizations relying on Ironic for automated server deployment and decommissioning will face service outages, affecting provisioning pipelines and causing operational delays. Unlike a targeted attack requiring credentials, this unauthenticated vector means any internet-facing or insufficiently segmented Ironic deployment is at immediate risk of disruption.

Affected systems

OpenStack Ironic versions 32 through 36 are vulnerable. Version 37.0.0 and later contain the fix. Ironic is commonly deployed in large-scale cloud and infrastructure-as-a-service environments for bare-metal provisioning. Operators using Ironic should verify their current version against their deployment inventory.

Exploitability

Exploitation is straightforward and requires minimal adversary capability. An attacker needs only network access to an Ironic API or JSON-RPC endpoint and knowledge of the vulnerable endpoint paths. No authentication, special privileges, or user interaction is required. The barrier to weaponization is low, making this a practical denial-of-service vector for any exposed Ironic service. However, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited public exploit activity at the time of publication.

Remediation

Apply the security update to Ironic version 37.0.0 or later. If immediate patching is unavailable, implement strict network access controls to limit connectivity to Ironic endpoints to trusted administrative networks and orchestration systems. Use firewalls, VPNs, or network segmentation to prevent untrusted sources from reaching the vulnerable API and JSON-RPC services. Input validation hardening in a proxy layer may provide temporary mitigation but is not a substitute for patching.

Patch guidance

Verify that your OpenStack Ironic deployment is running version 37.0.0 or a later release. Consult the official OpenStack security advisories and release notes for specific upgrade procedures. Before upgrading, test patches in a staging environment to ensure compatibility with your configuration, custom extensions, or downstream integrations. Plan maintenance windows to minimize disruption to provisioning workloads.

Detection guidance

Monitor Ironic API and JSON-RPC service logs for unexpected crashes or restart events correlated with unusual JSON payloads. Implement network telemetry to detect repeated failed requests with malformed or oversized JSON from external sources. Alert on service restarts without scheduled maintenance. Intrusion detection systems tuned to the Ironic endpoints may flag suspicious JSON patterns; work with your security team to refine signatures to reduce false positives while catching genuine attack attempts.

Why prioritize this

Although the CVSS score of 5.3 (Medium) reflects a denial-of-service impact rather than data breach or code execution, the unauthenticated nature and ease of exploitation elevate practical risk. The vulnerability affects critical infrastructure provisioning services, and any downtime has cascading operational consequences. Organizations should prioritize this patch alongside their regular update cycles, treating it more urgently than the base score alone might suggest, especially if Ironic is internet-facing or accessible from untrusted networks.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible, low-complexity attack requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), resulting in availability loss (A:L) with no confidentiality or integrity impact (C:N/I:N). The Scope is Unchanged (S:U), limiting the impact to the Ironic service itself. While the score is Medium, the ease of triggering and lack of authentication requirements mean the real-world risk may justify faster remediation timelines than the score suggests.

Frequently asked questions