medium6.3
CVE-2026-90461
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Impact
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
Affected products
| Product | Affected versions |
|---|---|
| OpenStack Ironic | through 38.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.