OpenStack Ironic CVE-2026-89419

Requires a valid authenticated account with network access to the Ironic REST API (PR:L, AV:N) and the ability to send a PATCH request to /v1/nodes/{ident}. The flaw lies in a policy/authorization enforcement gap on the general node-update path that is not present on the dedicated maintenance endpoint. Limiting factors: exploitation is intermittent - the description states the change is allowed only 'sometimes', and the exact triggering conditions are not described in the available sources (consistent with AC:H); unauthenticated access cannot reach it, and the practical impact is limited to toggling a node's maintenance flag. Affected: OpenStack Ironic before 39.0.1; fixed in 39.0.1.

This is a medium-severity authorization flaw (input CVSS 5.0, CWE-424 Improper Protection of Alternate Path) that is a real but low-priority issue. The supplied vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L shows network reach but is tempered by two meaningful brakes: PR:L means a valid authenticated account is required, and AC:H plus the description's word 'sometimes' indicate the condition does not trigger reliably. No EPSS score was provided in the input and the CVE is not listed in CISA KEV, so there is no public-exploitation signal; the two references are a Launchpad bug report and vendor advisory OSSA-2026-048, neither of which is working exploit code. The vuln.today Decision label is 'this_month' (not act_now or emergency), consistent with a patch-on-normal-cycle posture rather than drop-everything. Net: a genuine authorization-bypass worth patching, but neither widely exploited nor trivially weaponizable. One mismatch to verify: the input CVSS lists C:L (some confidentiality impact) yet the description only describes changing a maintenance setting, which is an integrity/authorization issue - verify with the OSSA advisory whether any data exposure actually occurs.

An authenticated OpenStack tenant or operator who is not authorized to toggle a node's maintenance state via the dedicated maintenance endpoint instead issues a generic PATCH to /v1/nodes/{ident}. Under some conditions Ironic applies the maintenance change along the general update path, bypassing the authorization control enforced on the specific endpoint. No public exploit code is identified at time of analysis; the trigger conditions that make this work only 'sometimes' are not described in the available sources.