What is the CVSS score of CVE-2026-71201?

CVE-2026-71201 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

OpenStack Ironic CVE-2026-71201

EUVD-2026-53124 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-05 mitre

GHSA-x4h6-wf22-px84

Authentication Bypass Ironic

5.0

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

5.0 MEDIUM

Network-reachable API, low-privilege authenticated reader required (PR:L), scope change reflects cross-tenant data leakage (S:C), confidentiality limited to Portgroup metadata only (C:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:04 vuln.today

DescriptionCVE.org

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.

AnalysisAI

Incorrect authorization in OpenStack Ironic through 38.0.0 allows an authenticated low-privilege project reader to leak Portgroup configuration data belonging to Nodes owned or leased by other tenants via a crafted API request. The flaw breaks multi-tenant isolation - a core security guarantee of shared cloud infrastructure - enabling cross-project enumeration of bare-metal network topology. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege project-reader API token

Delivery

Craft Portgroup API request targeting out-of-scope Node references

Exploit

Bypass Ironic authorization scope check

Execution

Receive Portgroup metadata from another tenant's Nodes

Impact

Enumerate cross-tenant bare-metal network topology

Access

Obtain low-privilege project-reader API token

Delivery

Craft Portgroup API request targeting out-of-scope Node references

Exploit

Bypass Ironic authorization scope check

Execution

Receive Portgroup metadata from another tenant's Nodes

Impact

Enumerate cross-tenant bare-metal network topology

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated OpenStack identity with at minimum the 'project reader' role in the Ironic API (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) is consistent with a low-privilege, network-reachable information disclosure that crosses tenant boundaries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker holding a low-privilege project-reader credential in a shared OpenStack cloud crafts a Portgroup listing API request with manipulated filters or node references that bypass project-scoping checks in Ironic. The API returns Portgroup records - including bonding configuration, associated Node UUIDs, and port membership - belonging to Nodes owned or leased by a different tenant. …
Remediation	No vendor-released patch with a confirmed fixed version has been independently verified at time of analysis - only an upstream Launchpad bug (https://bugs.launchpad.net/ironic/+bug/2162715) is referenced. … Detailed patch versions, workarounds, and compensating controls in full report.