EUVD-2026-53124
GHSA-x4h6-wf22-px84
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Network-reachable API, low-privilege authenticated reader required (PR:L), scope change reflects cross-tenant data leakage (S:C), confidentiality limited to Portgroup metadata only (C:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
AnalysisAI
Incorrect authorization in OpenStack Ironic through 38.0.0 allows an authenticated low-privilege project reader to leak Portgroup configuration data belonging to Nodes owned or leased by other tenants via a crafted API request. The flaw breaks multi-tenant isolation - a core security guarantee of shared cloud infrastructure - enabling cross-project enumeration of bare-metal network topology. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated OpenStack identity with at minimum the 'project reader' role in the Ironic API (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) is consistent with a low-privilege, network-reachable information disclosure that crosses tenant boundaries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with a confirmed fixed version has been independently verified at time of analysis - only an upstream Launchpad bug (https://bugs.launchpad.net/ironic/+bug/2162715) is referenced. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file overwrite in OpenStack Ironic (bare-metal provisioning service) lets an authenticated tenant supply a cra
Boot script injection in OpenStack Ironic versions up to and including 35.0.x allows authenticated tenants to influence
Credential forwarding vulnerability in OpenStack Ironic's idrac driver allows authenticated attackers to steal time-limi
Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows remote unauthenticated attackers to crash the ba
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to
Unredacted iSCSI credential disclosure in OpenStack Ironic through 35.0.1 occurs specifically when an authenticated oper
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obt
Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to ex
Cross-tenant information disclosure in OpenStack Ironic before 38.0.1 exposes residual disk contents from prior bare met
File extraction from the Ironic conductor service is possible via a crafted pxe_template, as disclosed in OpenStack Secu
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today