OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

HIGH 7.5CVE-2026-50589 · GHSA-q3g8-rjrx-59ph · PYSEC-2026-216 · Published 05/06/2026 · updated 23/07/2026

Package	Affected versions	Patched versions
ironic PyPI	`≥ 32.0.0, < 37.0.0`	`37.0.0`
ironic openstack	`≥ 32.0.0, < 37.0.0`	`37.0.0`

Description

In OpenStack Ironic 32.0.0 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

NVD description

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

References

nvd.nist.gov/vuln/detail/CVE-2026-50589 · ADVISORY
access.redhat.com/security/cve/CVE-2026-50589 · WEB
bugs.launchpad.net/ironic/+bug/2154288 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
openstack/ironic · PACKAGE
pypa/advisory-database · WEB
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50589.json · WEB
wiki.openstack.org/wiki/OSSN/OSSN-0099 · WEB
openwall.com/lists/oss-security/2026/06/06/2 · WEB
GitHub Advisory GHSA-q3g8-rjrx-59ph · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free