EUVD-2026-58824
GHSA-5j9p-9q2x-wxjm
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-accessible API, low-privilege tenant triggers fault; AC:H reflects specific interface-selection timing condition; S:C and C:H capture cross-tenant residual disk exposure.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
AnalysisAI
Cross-tenant information disclosure in OpenStack Ironic before 38.0.1 exposes residual disk contents from prior bare metal node occupants when the autodetect deploy interface is used. The bug causes the mandatory cleaning step to be skipped immediately after a node is enrolled with, or transitioned to, the autodetect deploy interface, meaning a newly allocated tenant may receive a node whose storage has not been wiped. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target bare metal node was enrolled with the autodetect deploy interface, or had its deploy interface changed to autodetect, and that cleaning did not subsequently execute before the node was allocated to a new tenant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) captures a genuinely significant cross-tenant risk despite the medium-range base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or curious tenant authenticates to the OpenStack Ironic API and requests allocation of a bare metal node that was recently enrolled using the autodetect deploy interface. Because cleaning did not execute at enrollment time, the node's disks still contain the filesystem, credentials, or application data of the previous occupant. … |
| Remediation | The primary fix is to upgrade OpenStack Ironic to version 38.0.1 or later, which resolves the cleaning synchronization failure in the autodetect deploy interface. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file overwrite in OpenStack Ironic (bare-metal provisioning service) lets an authenticated tenant supply a cra
Boot script injection in OpenStack Ironic versions up to and including 35.0.x allows authenticated tenants to influence
Credential forwarding vulnerability in OpenStack Ironic's idrac driver allows authenticated attackers to steal time-limi
Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows remote unauthenticated attackers to crash the ba
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to
Unredacted iSCSI credential disclosure in OpenStack Ironic through 35.0.1 occurs specifically when an authenticated oper
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obt
Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to ex
Incorrect authorization in OpenStack Ironic through 38.0.0 allows an authenticated low-privilege project reader to leak
File extraction from the Ironic conductor service is possible via a crafted pxe_template, as disclosed in OpenStack Secu
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today