{"affected":[{"defaultStatus":"unaffected","product":"Ironic","source":"CNA: mitre","vendor":"OpenStack","versions":[{"lessThan":"29.1.1","status":"affected","version":"17.0.0","versionType":"semver"},{"lessThan":"32.1.1","status":"affected","version":"30.0.0","versionType":"semver"},{"lessThan":"35.1.1","status":"affected","version":"33.0.0","versionType":"semver"},{"lessThan":"39.0.1","status":"affected","version":"36.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-89419","cwes":["CWE-424"],"description":"OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.","epss":{"date":"2026-11-02","percentile":0.21373,"score":0.00288},"exploits":[],"kev":null,"metrics":[{"score":5,"severity":"medium","source":"CNA: mitre","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793631442596,"publishedAt":1792727049648,"references":[{"source":"CNA: mitre","tags":[],"url":"https://bugs.launchpad.net/ironic/+bug/2166510"},{"source":"CNA: mitre","tags":[],"url":"https://security.openstack.org/ossa/OSSA-2026-048.html"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/22/7"}],"remediation":[],"revision":"04e915a50178aee726cda4f9c8939f3e0ad9199349b8e589027c194982f929d6","sources":[{"modifiedAt":1793631442596,"name":"CNA: mitre","retrievedAt":1793632156438,"url":"https://www.cve.org/CVERecord?id=CVE-2026-89419"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793632157528,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89419"}],"ssvc":{"assessedAt":1793631426477,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2026-89419","updatedAt":1793632157528}