CVE-2026-90458
Description
A path traversal vulnerability was found in OpenStack Ironic Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges could use a crafted subscription id to access or delete arbitrary Redfish resources on a node's BMC.
Statement
This flaw is rated Moderate based on CVSS scoring with high privileges required by default. The vendor passthrough API is gated by the baremetal:node:vendor_passthru policy, which defaults to system-scoped administrator access. Exploitation is confined to the BMC Redfish management plane. Red Hat product impact analysis is in progress for products that ship openstack-ironic.
Mitigation
There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:
1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.
2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.
3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Red Hat CVSS v3 Score Explanation
Default vendor_passthru is system-scoped admin (PR:H). Confirmed with Julia Kreger: custom policy would be required to widen access, and Red Hat does not support custom policies. Metal3 uses Kubernetes RBAC with the same admin-only posture (Dmitry Tantsur). GET has no sensitive data. DELETE toward BMC AccountService is hardware-dependent and unproven, so C/I/A stay Low. Availability left Low: workload disruption is theoretical without a demonstrated exploit.
Acknowledgements
Upstream acknowledges Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) as the original reporters.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
