OpenStack Ironic 38.0.0 Info Disclosure: crossproj Portgroups
CVE-2026-71201 Published on August 5, 2026
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
Vulnerability Analysis
CVE-2026-71201 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-71201. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-71201 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71201
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 1.0.0, <= 29.0.6 is affected.
- Version 30.0.0, <= 32.0.1 is affected.
- Version 33.0.0, <= 35.0.1 is affected.
- Version 36.0.0, <= 38.0.0 is affected.