Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN999
_____________________________________________________________________

DATE                : 09/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running ironic versions prior to
                              29.1.1, 32.1.1, 35.1.1,  .

====================================================================
https://docs.openstack.org/security-notes/OSSN-0110.html
_____________________________________________________________________


OSSN-0110: Ironic can leak basic auth credentials to image server
(2026-10-08)


Summary

Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software
Technology) from the Metal3.io security team reported a vulnerability
in Ironic. When [deploy]/image_server_auth_strategy option is
configured for HTTP(S) Basic Authentication, the operator’s image
server username and password are sent to every host from which image
data is requested. Any tenant with access to perform a deployment can
set instance_info/image_source or instance_info/image_checksum to a
host they control, triggering this vulnerability.


Affected Services / Software

    ironic (‘>=24.0.0 <29.1.1, >=30.0.0 <32.1.1, >=33.0.0 <35.1.1, >=36.0.0 <39.0.0’)

Discussion

The fix adds a [deploy]/image_server_auth_hosts option allowing
operators to restrict the hosts to which credentials are sent, along
with a [deploy]/image_server_auth_permit_unknown_hosts option.

Deployments of OpenStack-integrated Ironic typically use Glance for
image management and are not impacted by this vulnerability.


Recommended Actions

Operators utilizing the basic auth feature for image retrieval
should:

    Apply the relevant patch for their release

    set [deploy]/image_server_auth_hosts to a list of acceptable hosts
to pass authentication credentials to

    set [deploy]/image_server_auth_permit_unknown_hosts to False

Ironic intends to change the default of
[deploy]/image_server_auth_permit_unknown_hosts to False in the
2027.1 release. See https://review.opendev.org/999907 for more
information.


Patches

    2027.1/indri: The fix for this CVE was merged before 2027.1
      was branched.

    2026.2/hibiscus: https://review.opendev.org/999744

    2026.1/gazpacho: https://review.opendev.org/1003587

    2025.2/flamingo: https://review.opendev.org/1003597

    2025.1/epoxy: https://review.opendev.org/1003598

    bugfix/38.0: https://review.opendev.org/1003577

    bugfix/37.0: https://review.opendev.org/1003579


Credits:

    Tuomo Tanskanen, Metal3.io Security Team (Ericsson
      Software Technology)

    Dmitry Tantsur, Metal3.io Security Team (Red Hat)


Contacts / References

Author: Jay Faulkner (G-Research OSS)

    Original bug : https://launchpad.net/bugs/2162816

    This OSSN : https://docs.openstack.org/security-notes/OSSN-0110.html

    Mailing List : openstack-discuss@lists.openstack.org

    OpenStack Security : https://security.openstack.org/

    CVE-2026-90461 : https://nvd.nist.gov/vuln/detail/CVE-2026-90461

this page last updated: 2026-10-08 17:32:58


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================