CVE-2026-50589
Fixed in a distro release EPSS <1%CVSS 5.3
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
Products: OpenStack Ironic, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ironic | 37.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | openstack-ironic-2025.2 | 0 |
| Chainguard | openstack-ironic-2026.1 | 0 |
| Debian 14 | ironic | 1:35.0.1-5 |
| Ubuntu 16.04 LTS | ironic | no fix |
| Ubuntu 18.04 LTS | ironic | no fix |
| Ubuntu 20.04 LTS | ironic | no fix |
| Ubuntu 22.04 LTS | ironic | no fix |
| Ubuntu 24.04 LTS | ironic | no fix |
| Ubuntu 25.10 | ironic | no fix |
| Ubuntu 26.04 LTS | ironic | no fix |
| Ubuntu 26.10 | ironic | no fix |