CVE-2026-54421: OpenStack Ironic Credential Leak via PATCH Request

Technical summary

CVE-2026-54421 stems from improper output filtering in OpenStack Ironic's volume property patching logic. When a PATCH request modifies authorized volume configuration fields, the API response fails to redact sensitive authentication material embedded in the response payload. The vulnerability is specific to PATCH semantics; equivalent POST operations do not exhibit the flaw. This is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transmission).

Business impact

Organizations deploying OpenStack Ironic for infrastructure-as-a-service provisioning face credential exposure risk if admin or operator accounts perform volume property updates. An attacker with sufficient role-based access could obtain iSCSI credentials without needing direct access to configuration files or secrets management systems, potentially enabling lateral movement to block storage infrastructure or data theft.

Affected systems

OpenStack Ironic versions prior to 37.0.1 are affected. POST-based volume operations are unaffected. The vulnerability requires the attacker to hold authorization to modify volume properties, limiting exposure to privileged or service accounts within the same OpenStack deployment.

Exploitability

Exploitability is moderate and gated by authentication and authorization. An attacker must already possess credentials for an OpenStack account with permissions to patch volume properties—typically operator or admin roles. Once authenticated, triggering the leak requires only a standard PATCH HTTP request to a volume endpoint. No complex attack chains, race conditions, or user interaction is required. Network access to the Ironic API is necessary.

Remediation

Upgrade OpenStack Ironic to version 37.0.1 or later, which implements proper redaction of sensitive fields in PATCH response payloads. Organizations should verify patching status across all Ironic control plane nodes. As an interim measure, restrict volume property modification permissions to minimal sets of accounts and audit PATCH request logs for unauthorized modification attempts.

Patch guidance

Apply the official OpenStack Ironic update to 37.0.1 or later. Coordinate patching with your OpenStack deployment lifecycle to avoid service disruption during control plane node updates. Verify the patch by confirming the Ironic version via API queries (e.g., `GET /versions`) and by testing a non-production volume PATCH operation to confirm credentials are no longer returned in the response.

Detection guidance

Monitor Ironic API logs for PATCH requests to `/v1/volume/*` or equivalent endpoints, particularly from non-standard service accounts or during non-maintenance windows. Audit API response payloads for the presence of iSCSI credential strings (patterns like `iscsi_username`, `iscsi_password`, `iscsi_secret`). Enable and review role-based access control logs to identify accounts that have permission to modify volume properties. SIEM rules should flag any PATCH operations followed by credential-like strings in the response.

Why prioritize this

This is a medium-severity credential exposure flaw that requires pre-existing authentication and role-based authorization to exploit. However, the unintended return of sensitive material in API responses poses a material risk to confidentiality. Given the gated nature of the attack surface and absence of active exploitation tracking, this should be prioritized after critical RCE and authentication bypass flaws, but ahead of lower-severity issues. Organizations with strict credential management policies or those that rotate iSCSI credentials frequently may lower urgency slightly.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) reflects a high confidentiality impact (C:H) offset by high privilege requirements (PR:H) and no integrity or availability impact. The network attack vector (AV:N) and low attack complexity (AC:L) indicate the flaw is easy to trigger once access is gained. The scope change (S:C) implies the impact can affect resources beyond the vulnerable component. The score appropriately penalizes the authorization gate while recognizing the severity of unredacted credential exposure.

Frequently asked questions