Is CVE-2026-90461 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-90461?

CVE-2026-90461 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-90461

Description

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.