CVE-2026-54421 describes a vulnerability in OpenStack Ironic versions up to 35.0.1 where applying a PATCH request to update volume properties authorized for the user can cause the system to return sensitive information without redaction. This includes credentials like iSCSI details. The vulnerability is related to improper handling of sensitive data (CWE-212). The POST method for similar updates does not expose this sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact.

An attacker with high privileges authorized to update volume properties via PATCH can receive sensitive information such as iSCSI credentials that should have been redacted. This could lead to unauthorized access to storage resources or credential leakage. There is no impact on integrity or availability. The vulnerability does not affect POST requests, limiting the attack surface to PATCH operations.

Patch status is not yet confirmed — check the OpenStack vendor advisory for current remediation guidance. Until a fix is available, restrict PATCH operations on volume properties to trusted administrators only and monitor for unusual access patterns. Avoid using PATCH requests for volume property updates if possible. Follow official OpenStack security advisories for updates.