OpenStack Ironic CVE-2026-54421

Exploitation requires an authenticated Ironic operator- or admin-level session with sufficient RBAC permissions to issue PATCH requests against volume connector or volume target resources on at least one node (PR:H per CVSS). The sensitive data is only returned via the PATCH response path - the same endpoint under POST does not exhibit this behavior, per the CVE description. The target node must have volume properties containing credential-bearing fields such as iSCSI CHAP username and secret; Ironic deployments using only local storage or storage configurations that carry no credentials in volume properties would not expose sensitive data. There is no required user interaction beyond the attacker issuing the PATCH API call directly. Exploitation is limited by the PR:H requirement - unauthenticated or low-privilege users cannot trigger the disclosure.

The CVSS 3.1 score of 6.8 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N is well-calibrated: the network attack vector and low complexity reflect straightforward API exploitation, but PR:H meaningfully constrains the threat surface to already-privileged Ironic operators or administrators. The S:C and C:H combination correctly signals that the real damage occurs outside Ironic - leaked iSCSI credentials can grant direct, unmediated access to storage targets independently of Ironic's authorization model. In multi-tenant cloud deployments where operator-role API access is distributed across multiple teams or automation accounts, the practical risk is higher than the raw score suggests, as a compromised or malicious operator can silently extract storage credentials during routine PATCH operations. No EPSS data was provided, and the absence of KEV listing or public exploit code indicates no confirmed mass exploitation at time of analysis. The risk is real but scoped to environments with iSCSI or similarly credential-bearing volume configurations.

An Ironic operator-level user with legitimate API credentials issues a PATCH request to update a non-sensitive authorized field (such as a volume connector property) on a node that has iSCSI volume targets configured with CHAP authentication. The Ironic API processes the update and returns the full updated resource representation, including unredacted iSCSI CHAP username and secret. The operator captures these credentials from the API response and authenticates directly to the iSCSI storage target outside of Ironic, gaining unauthorized read/write access to the underlying block device.