What is the CVSS score of CVE-2026-50589?

CVE-2026-50589 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenStack Ironic are affected by CVE-2026-50589?

OpenStack Ironic bare-metal provisioning service (versions 32-35.0.1) is vulnerable to unauthenticated denial-of-service attacks via crafted JSON payloads, which crash the provisioning service and…. A patch is available.

How to fix or mitigate CVE-2026-50589?

Within 24 hours: Identify all OpenStack Ironic deployments; confirm which systems run versions 32, 33, 34, or 35.0.1; document network exposure of API and JSON-RPC endpoints. Within 7 days: Restrict inbound access to Ironic API/JSON-RPC endpoints to trusted administrative networks via firewall rules; enable rate limiting and connection throttling on JSON request handlers; implement request logging to detect malformed payload submissions. Within 30 days: Subscribe to OpenStack Security Note OSSN-0099 for patch release notification; develop and test upgrade plan to Ironic 36.0 or later; evaluate architectural isolation of bare-metal provisioning infrastructure.

OpenStack Ironic CVE-2026-50589

EUVD-2026-34774 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-04 mitre

GHSA-q3g8-rjrx-59ph

Denial Of Service Ironic

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated remote JSON payload crashes the service with no user interaction, no confidentiality or integrity impact, only high availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 16, 2026 - 20:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 16, 2026 - 20:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 16, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jun 16, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Jun 16, 2026 - 20:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jun 05, 2026 - 00:31 vuln.today

DescriptionNVD

In OpenStack Ironic 32 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

AnalysisAI

Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows remote unauthenticated attackers to crash the bare-metal provisioning service by submitting a crafted JSON payload to certain API or JSON-RPC endpoints. CVSS 7.5 reflects high availability impact with no authentication required, though EPSS is only 0.04% (12th percentile) and SSVC marks exploitation as 'none' - no public exploit identified at time of analysis. The flaw is tracked as a CWE-770 unbounded resource consumption issue and documented in OpenStack Security Note OSSN-0099.

Technical ContextAI

OpenStack Ironic is the bare-metal provisioning service within OpenStack, exposing a REST API and a JSON-RPC interface that conductors and API workers use to coordinate node management. CPE cpe:2.3:a:openstack:ironic covers versions 32 through 35.0.1 of the upstream component. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the JSON parsing or request-handling path in some endpoints does not bound the resources consumed when processing attacker-controlled JSON, allowing a single crafted payload to exhaust memory, CPU, or worker threads and crash the daemon. OSSN-0099 and the Launchpad bug 2154288 are the authoritative upstream references.

RemediationAI

Upstream fix available per OSSN-0099 and the Launchpad bug; a released patched version is not independently confirmed from the input data, so operators should consult OSSN-0099 (https://wiki.openstack.org/wiki/OSSN/OSSN-0099) and the Ironic stable branch advisories to identify the specific 35.0.x or later point release that contains the fix and upgrade accordingly. Until upgraded, restrict network exposure of both the Ironic API endpoint and the JSON-RPC service to the management/control-plane network only via firewall or security-group rules - this is the highest-value compensating control because the bug is unauthenticated and remotely reachable, with the trade-off that any tooling reaching Ironic from outside that segment will need to be re-homed. Additional defenses include placing a reverse proxy or WAF in front of the Ironic API to enforce JSON size and structural limits and rate-limit per source IP, which mitigates resource-exhaustion payloads but adds an operational component and may break very large legitimate requests. Monitor the oss-security thread (https://seclists.org/oss-sec/2026/q2/823 and http://www.openwall.com/lists/oss-security/2026/06/06/2) for the confirmed fix tag.