{"id":"CVE-2026-90458","published":"2026-10-23T04:18:19.367","lastModified":"2026-10-23T19:43:46.190","description":"OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-1287"],"vendors":[],"products":[],"references":[{"url":"https://bugs.launchpad.net/ironic/+bug/2166507","tags":[]},{"url":"https://security.openstack.org/ossa/OSSA-2026-047.html","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/6","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}