VulnSocial

CVE-2026-54421General

LOWCVSS 6.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-212

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-14); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-14: 1Mentions · 2026-06-18: 1Technical Details · 2026-06-14: 1Technical Details · 2026-06-18: 106-1406-18
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-141
General1
2026-06-181
Disclosure1
Full discourse2 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    OpenStack OSSA-2026-022: Nova: Scheduler hint injection bypasses Placement resource claims and scheduling constraints (CVE-2026-46448) https://www.openwall.com/lists/oss-security/2026/06/16/5 OSSA-2026-023: Ironic: Sensitive properties returned unredacted in HTTP response (CVE-2026-54421) https://www.openwall.com/lists/oss-security/2026/06/16/10

    Post summary

    OpenWall’s mailing list announced two new OpenStack CVEs in 2026: CVE-2026-46448 in Nova’s scheduler hint injection, and CVE-2026-54421 in Ironic exposing sensitive properties.

    10010189
    4.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-54421 Unredacted Sensitive Information Disclosure in OpenStack Ironic Volume Properties PATCH https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54421

    Post summary

    The snippet references CVE-2026-54421 with a brief description of a sensitive information disclosure and provides a link for further details, but lacks explicit PoC, exploit, active exploitation claims, or patch information.

    0000063
    4.0K followersView on X

Explore more

Back to dashboard