CVE-2026-71201
published 2026-08-05CVE-2026-71201: In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another…
PriorityP427medium5CVSS 3.1
AVNACLPRLUINSCCLINAN
EPSS
0.28%
19.5th percentile
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
Affected
135 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-baremetal-rhel8-operator | — | — |
| openshift4 | ose-baremetal-rhel9-operator | — | — |
| openshift4 | ose-ironic-agent-rhel9 | — | — |
| openshift4 | ose-ironic-machine-os-downloader-rhel9 | — | — |
| openshift4 | ose-ironic-rhel9 | — | — |
| openshift4 | ose-ironic-static-ip-manager-rhel9 | — | — |
| openstack | ironic | 1.0.0 – 29.0.6 | — |
| openstack | ironic | 30.0.0 – 32.0.1 | — |
| openstack | ironic | 33.0.0 – 35.0.1 | — |
| openstack | ironic | 36.0.0 – 38.0.0 | — |
| rhoso-operators | ironic-rhel9-operator | — | — |
| rhoso-operators | openstack-operator-bundle | — | — |
| rhoso-operators | openstack-rhel9-operator | — | — |
| rhoso | ironic-python-agent-rhel9 | — | — |
| rhoso | openstack-cinder-api-rhel9 | — | — |
| rhoso | openstack-cinder-backup-rhel9 | — | — |
| rhoso | openstack-cinder-base-rhel9 | — | — |
| rhoso | openstack-cinder-scheduler-rhel9 | — | — |
| rhoso | openstack-cinder-volume-rhel9 | — | — |
| rhoso | openstack-glance-api-rhel9 | — | — |
| rhoso | openstack-ironic-api-rhel9 | — | — |
| rhoso | openstack-ironic-base-rhel9 | — | — |
| rhoso | openstack-ironic-conductor-rhel9 | — | — |
| rhoso | openstack-ironic-inspector-rhel9 | — | — |
| rhoso | openstack-ironic-neutron-agent-rhel9 | — | — |
CVSS provenance
nvdv3.15.0MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenStack Ironic Portgroups access control (Nessus ID 332253 / CNNVD-2026-72144800)
vuldb·2026-08-05·CVSS 5.0
CVE-2026-71201 [MEDIUM] OpenStack Ironic Portgroups access control (Nessus ID 332253 / CNNVD-2026-72144800)
A vulnerability was found in OpenStack Ironic. It has been rated as problematic. This issue affects some unknown processing of the component Portgroups. This manipulation causes improper access controls.
This vulnerability is handled as CVE-2026-71201. The attack can be initiated remotely. There is not any exploit available.
GHSA
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
ghsa_unreviewed·2026-08-05
CVE-2026-71201 [MEDIUM] CWE-863 In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
Red Hat
ironic: OpenStack Ironic: Information disclosure via crafted request
vendor_redhat·2026-08-05·CVSS 5.0
CVE-2026-71201 [MEDIUM] CWE-639 ironic: OpenStack Ironic: Information disclosure via crafted request
ironic: OpenStack Ironic: Information disclosure via crafted request
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
A flaw was found in OpenStack Ironic. A project reader can exploit this vulnerability by sending a specially crafted request to the Ironic service. This allows the reader to access Portgroups that are assigned to Nodes belonging to or leased by other projects, leading to unauthorized information disclosure.
Statement: This flaw has a moderate impact as OpenStack Ironic contains an authorization flaw in the Portgroups listing API. When a project-scoped reader lists portgroups by shard name, the service fails to apply the per-project ownership filter that
No detection rules found.
No public exploits indexed.
2026-08-05
Published