OpenStack Ironic EUVD-2026-30209

Low-privileged authenticated access to the OpenStack Ironic API is required (CVSS PR:L); unauthenticated exploitation is not possible. The attacker must have sufficient API permissions to submit an image URL as part of an Ironic provisioning or image-handling request, specifically the ability to set or influence the image URL parameter accepted by Ironic's image handling component. The vulnerability is triggered by supplying the specific value file:///dev/zero (or any file:// path pointing to an infinite data source). Limiting factors: valid OpenStack credentials are mandatory; the attack is rated non-automatable by SSVC, implying each trigger requires deliberate per-request action; the impact scope is unchanged (S:U), meaning the damage is confined to the Ironic conductor process itself; and the availability impact is rated Low (A:L) by CVSS, though conductor disruption may feel more severe in bare-metal-heavy environments.

CVSS 4.3 Medium with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L places this as network-reachable but requiring low-privileged credentials, with only partial availability impact. EPSS at 0.01% (2nd percentile) is very low, indicating minimal observed exploitation activity in the wild, consistent with the absence of a CISA KEV entry. SSVC rates exploitation as 'poc', automatable as 'no', and technical impact as 'partial', aligning with CVSS. The CVSS A:L rating may understate operational risk slightly: an infinite loop on the Ironic conductor can block all concurrent bare-metal provisioning tasks until the process is killed or resources exhausted, which in production environments could be functionally more disruptive than 'Low' implies. However, the PR:L requirement means an attacker must already hold valid OpenStack credentials, significantly limiting the attack surface to insider threat or compromised low-privilege accounts. No conflict between data sources was identified; all signals converge on a real but limited-scope threat.

An attacker holding a low-privileged OpenStack account submits a bare-metal provisioning request to the Ironic API, specifying file:///dev/zero as the image URL. The Ironic conductor accepts the request and begins computing a checksum against /dev/zero, which returns null bytes indefinitely. The conductor thread enters an infinite loop, degrading or halting bare-metal provisioning availability for all other users until the process is manually restarted. A proof-of-concept reportedly exists per SSVC data, lowering the skill threshold for exploitation.