VDB
Sign up
MEDIUM6.8

PYSEC-2026-3852

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Quick fix

PYSEC-2026-3852 — ironic: upgrade to the fixed version with the command below.

pip install --upgrade 'ironic>=29.0.6'

Details

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/ironic
Introduced in: 17.0.0Fixed in: 29.0.6
Fixpip install --upgrade 'ironic>=29.0.6'

References