{"id":"CVE-2026-89419","published":"2026-10-23T04:18:19.113","lastModified":"2026-10-23T19:43:46.190","description":"OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.","cvssScore":5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","cwes":["CWE-424"],"vendors":[],"products":[],"references":[{"url":"https://bugs.launchpad.net/ironic/+bug/2166510","tags":[]},{"url":"https://security.openstack.org/ossa/OSSA-2026-048.html","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/7","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}