{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "OpenStack Ironic: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/openstack--ironic/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/openstack--ironic/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90458/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90458/",
   "title": "CVE-2026-90458 · OpenStack Ironic · disclosed",
   "content_text": "OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.",
   "date_published": "2026-10-23T03:50:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89419/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89419/",
   "title": "CVE-2026-89419 · OpenStack Ironic · disclosed",
   "content_text": "OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.",
   "date_published": "2026-10-23T03:44:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115638/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115638/",
   "title": "CVE-2026-115638 · OpenStack Ironic · disclosed",
   "content_text": "OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.",
   "date_published": "2026-10-23T03:21:17Z"
  }
 ]
}