{"schema":"vulnpedia.research/1","cve":"CVE-2026-90458","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://bugs.launchpad.net/ironic/+bug/2166507","tags":["vendor-reference"],"source":"mitre","sourceId":"mitre","modified":"2026-10-23T03:50:48.611Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-23T03:50:48.611Z","url":"https://bugs.launchpad.net/ironic/+bug/2166507"},{"source":"nvd","sourceId":"CVE-2026-90458","modified":"2026-10-23T19:43:46.190","url":"https://bugs.launchpad.net/ironic/+bug/2166507"},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://bugs.launchpad.net/ironic/+bug/2166507"}]},{"url":"https://security.openstack.org/ossa/OSSA-2026-047.html","tags":[],"source":"mitre","sourceId":"mitre","modified":"2026-10-23T03:50:48.611Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2026-10-23T03:50:48.611Z","url":"https://security.openstack.org/ossa/OSSA-2026-047.html"},{"source":"nvd","sourceId":"CVE-2026-90458","modified":"2026-10-23T19:43:46.190","url":"https://security.openstack.org/ossa/OSSA-2026-047.html"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/6","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-23T04:13:17.252Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-23T04:13:17.252Z","url":"http://www.openwall.com/lists/oss-security/2026/10/22/6"},{"source":"nvd","sourceId":"CVE-2026-90458","modified":"2026-10-23T19:43:46.190","url":"http://www.openwall.com/lists/oss-security/2026/10/22/6"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-90458","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-90458"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548612","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548612"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90458","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-90458"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90458","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90458"}]},{"source":"euvd","sourceId":"EUVD-2026-108574","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108574","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-108574","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108574"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openshift_container_platform_4:openstack-ironic-api","product":"openstack-ironic-api as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openstack-ironic-api","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openshift_container_platform_4:openstack-ironic-common","product":"openstack-ironic-common as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openstack-ironic-common","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openshift_container_platform_4:openstack-ironic-conductor","product":"openstack-ironic-conductor as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openstack-ironic-conductor","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openshift_container_platform_4:openstack-ironic.src","product":"openstack-ironic.src as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openstack-ironic?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openshift_container_platform_4:python3-ironic-tests","product":"python3-ironic-tests as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/python3-ironic-tests","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_13_(queens):openstack-ironic-api","product":"openstack-ironic-api as a component of Red Hat OpenStack Platform 13 (Queens)","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-api","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_13_(queens):openstack-ironic-common","product":"openstack-ironic-common as a component of Red Hat OpenStack Platform 13 (Queens)","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-common","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_13_(queens):openstack-ironic-conductor","product":"openstack-ironic-conductor as a component of Red Hat OpenStack Platform 13 (Queens)","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-conductor","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_16.2:openstack-ironic-api","product":"openstack-ironic-api as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-api","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_16.2:openstack-ironic-common","product":"openstack-ironic-common as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-common","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_16.2:openstack-ironic-conductor","product":"openstack-ironic-conductor as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-conductor","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_16.2:openstack-ironic.src","product":"openstack-ironic.src as a component of Red Hat OpenStack Platform 16.2","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_17.1:openstack-ironic-api","product":"openstack-ironic-api as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-api","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_17.1:openstack-ironic-common","product":"openstack-ironic-common as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-common","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_17.1:openstack-ironic-conductor","product":"openstack-ironic-conductor as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic-conductor","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_17.1:openstack-ironic.src","product":"openstack-ironic.src as a component of Red Hat OpenStack Platform 17.1","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:rpm/redhat/openstack-ironic?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]},{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json","productId":"red_hat_openstack_platform_18.0:openstack-ironic.src","product":"openstack-ironic.src as a component of Red Hat OpenStack Platform 18.0","status":"known_affected","remediations":[{"category":"workaround","details":"There is no complete mitigation without the upstream patch. To reduce risk before an errata is available:\n\n1. Keep the baremetal:node:vendor_passthru policy at the default system administrator requirement; do not grant vendor passthrough to project-scoped roles.\n2. Restrict network access to the OpenStack Bare Metal (Ironic) API to trusted management networks.\n3. Avoid delete_subscription and get_subscription vendor passthrough calls with untrusted subscription ids until a fixed package is installed."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/openstack-ironic?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-90458","modified":"2026-10-23T04:06:19+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90458.json"}]}],"vendorCoverage":{"total":17,"shown":17,"omitted":0,"source":"redhat"}}