CVE-2026-74250
published 2026-08-14CVE-2026-74250: In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect…
PriorityP335medium6.3CVSS 3.1
AVNACHPRLUINSCCHINAN
EPSS
0.30%
21.2th percentile
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-ironic-rhel9 | — | — |
| openstack | ironic | >= 32.0.0 < 35.0.2 | 35.0.2 |
| openstack | ironic | >= 36.0.0 < 38.0.1 | 38.0.1 |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenStack Ironic up to 35.0.1/38.0.0 Autodetect Deploy Interface stack-based overflow
vuldb·2026-08-15·CVSS 6.3
CVE-2026-74250 [MEDIUM] OpenStack Ironic up to 35.0.1/38.0.0 Autodetect Deploy Interface stack-based overflow
A vulnerability was found in OpenStack Ironic up to 35.0.1/38.0.0. It has been classified as problematic. The affected element is an unknown function of the component Autodetect Deploy Interface. The manipulation leads to stack-based buffer overflow.
This vulnerability is listed as CVE-2026-74250. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
ghsa_unreviewed·2026-08-15
CVE-2026-74250 [MEDIUM] CWE-226 In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
Red Hat
ironic: OpenStack Ironic: Autodetect deploy interface fails to run cleaning
vendor_redhat·2026-08-14·CVSS 6.3
CVE-2026-74250 [MEDIUM] CWE-367 ironic: OpenStack Ironic: Autodetect deploy interface fails to run cleaning
ironic: OpenStack Ironic: Autodetect deploy interface fails to run cleaning
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
A flaw was found in OpenStack Ironic. The autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. This can lead to operational issues where necessary cleaning procedures are not executed.
Statement: A flaw was found in OpenStack Ironic. When using the autodetect deploy interface, the cleaning step may be skipped immediately after a node is enrolled or when changing to the autodetect deploy interface. This could allow data from a previous tenant to remain on th
No detection rules found.
No public exploits indexed.
2026-08-14
Published