OpenStack Ironic <38.0.1 - Autodetect Deploy Cleaning Failure
CVE-2026-74250 Published on August 14, 2026
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
Vulnerability Analysis
CVE-2026-74250 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Sensitive Information in Resource Not Removed Before Reuse
When a device releases a resource such as memory or a file for reuse by other entities, information contained in the resource is not fully cleared prior to reuse of the resource.
Products Associated with CVE-2026-74250
Want to know whenever a new CVE is published for OpenStack Ironic? stack.watch will email you.
Affected Versions
OpenStack Ironic:- Version 32.0.0 and below 35.0.2 is affected.
- Version 36.0.0 and below 38.0.1 is affected.