CVE-2026-71201 in Ironic
Summary
by MITRE • 08/05/2026
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
OpenStack Ironic represents a critical infrastructure component responsible for provisioning and managing bare metal servers within cloud environments, making it a prime target for privilege escalation attacks. This vulnerability specifically affects versions through 38.0.0 where a project reader role user can craft malicious requests to retrieve portgroups that are assigned to nodes owned or leased by different projects. The flaw stems from inadequate access control mechanisms within the Ironic service's API implementation, allowing unauthorized data disclosure across project boundaries. This represents a significant violation of information security principles and could enable attackers to gather sensitive metadata about other projects' infrastructure configurations, potentially exposing network topology details, hardware specifications, and resource allocation patterns.
The technical root cause of this vulnerability aligns with CWE-284 Access Control Issues, specifically manifesting as improper access control within the Ironic service's portgroup retrieval functionality. The flaw occurs when the API endpoint fails to properly validate whether the requesting user has appropriate permissions to access specific portgroups associated with nodes belonging to different projects. This type of cross-project information leakage can be categorized under ATT&CK technique T1046 Network Service Scanning and T1082 System Information Discovery, as it enables adversaries to discover system configurations and network infrastructure details that should remain isolated between projects.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables potential reconnaissance activities that could lead to more sophisticated attacks. An attacker with project reader privileges can gather detailed information about other projects' node configurations, which may include MAC addresses, network interface details, and hardware specifications. This intelligence could be leveraged for further exploitation attempts, such as crafting targeted attacks against specific hardware configurations or identifying potential vulnerabilities in other projects' deployments. The vulnerability particularly affects multi-tenant environments where proper isolation between projects is critical for maintaining security boundaries.
Mitigation strategies should focus on implementing proper access control validation within the Ironic service API endpoints that handle portgroup operations. Organizations should immediately upgrade to versions of OpenStack Ironic beyond 38.0.0 where this vulnerability has been addressed through enhanced permission checks and project isolation mechanisms. Additionally, administrators should review and tighten role-based access controls, ensuring that project readers cannot query resources belonging to other projects without explicit authorization. The implementation of proper API request validation and cross-project boundary enforcement represents the most effective approach to preventing this type of unauthorized data access. Organizations should also consider implementing network segmentation and monitoring solutions to detect anomalous querying patterns that might indicate exploitation attempts targeting this vulnerability, as this type of information disclosure can serve as a precursor to more serious attacks within cloud environments.