CVE-2026-71201 Overview
CVE-2026-71201 is an improper authorization vulnerability in OpenStack Ironic through version 38.0.0. A project-scoped reader can issue a crafted API request and retrieve Portgroup objects that belong to Nodes owned or leased by a different project. The flaw breaks the tenant isolation model that Ironic enforces for baremetal resources. The weakness is categorized as [CWE-863: Incorrect Authorization]. Exploitation requires only low-privilege authenticated access over the network and no user interaction.
Critical Impact
A read-only user in one project can enumerate Portgroup configuration data associated with baremetal Nodes belonging to another project, breaking cross-project isolation in multi-tenant OpenStack deployments.
Affected Products
- OpenStack Ironic through 38.0.0
- Multi-tenant OpenStack clouds exposing the Ironic baremetal API to project readers
- Deployments relying on Ironic project-scoped RBAC for Node and Portgroup isolation
Discovery Timeline
- 2026-08-05 - CVE CVE-2026-71201 published to NVD
- 2026-08-05 - Coordinated disclosure via the Openwall OSS Security Mailing and Launchpad Bug Report
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71201
Vulnerability Analysis
OpenStack Ironic manages baremetal Nodes and exposes related resources such as Ports and Portgroups through a REST API. Access to these resources is gated by project-scoped role-based access control. The intended policy limits a reader to Portgroups belonging to Nodes owned or leased by the reader's own project.
CVE-2026-71201 arises because a crafted query against the Portgroup endpoint bypasses the ownership and lease checks that Ironic performs on the parent Node. The API returns Portgroup records tied to Nodes owned or leased by other projects. The disclosed data can include Portgroup names, addresses, modes, and configuration properties useful for reconnaissance against another tenant's baremetal infrastructure.
The issue affects confidentiality only. Integrity and availability are not impacted, and the scope is changed because a subject in one security domain reads objects belonging to another.
Root Cause
The root cause is an authorization gap in the Portgroup listing and retrieval logic. Ironic evaluates the caller's project context against the Portgroup resource but does not consistently enforce the ownership or lease attributes of the parent Node when a specifically shaped query is submitted. This is a classic [CWE-863] incorrect authorization defect.
Attack Vector
The attacker authenticates to Keystone with any valid project-scoped account that holds the reader role. The attacker then submits a crafted request to the Ironic API targeting Portgroup resources. The response includes Portgroups belonging to Nodes owned or leased by other projects. No elevated privileges, tokens, or user interaction are required beyond the initial low-privileged authentication.
Exploitation code is not publicly available. See the Launchpad Bug Report for the upstream technical discussion.
Detection Methods for CVE-2026-71201
Indicators of Compromise
- Ironic API access logs showing Portgroup GET requests from project readers who do not own the referenced Nodes.
- Unusual query patterns against /v1/portgroups endpoints that include filters or parameters referencing Node UUIDs from other projects.
- Keystone tokens issued to low-privilege project readers being used at unexpected volume against baremetal endpoints.
Detection Strategies
- Correlate Ironic API access logs with Keystone project identifiers and Node ownership metadata to identify cross-project reads.
- Alert when a project reader retrieves Portgroup records associated with Nodes whose owner or lessee field does not match the caller's project.
- Baseline normal Portgroup query volume per project and flag statistical outliers.
Monitoring Recommendations
- Forward Ironic conductor and API logs, along with Keystone audit events, into a centralized data lake for cross-source correlation.
- Retain baremetal API access logs long enough to reconstruct enumeration attempts spanning multiple sessions.
- Monitor for enumeration bursts targeting Portgroup, Port, and Node endpoints from the same project token.
How to Mitigate CVE-2026-71201
Immediate Actions Required
- Inventory all OpenStack Ironic deployments and identify instances running versions up to and including 38.0.0.
- Restrict which project-scoped users hold the reader role on the baremetal service until a fixed release is deployed.
- Review Keystone role assignments and revoke unused reader roles in projects that share an Ironic control plane.
Patch Information
Refer to the Launchpad Bug Report and the Openwall OSS Security Mailing for upstream patch status. Upgrade to an Ironic release beyond 38.0.0 that includes the fix for CVE-2026-71201 once available from the OpenStack project.
Workarounds
- Tighten Ironic policy.yaml rules for Portgroup read operations to require an explicit ownership or lease match against the parent Node.
- Limit the reader role to trusted operators until the patched release is deployed.
- Place the Ironic API behind network controls that restrict access to trusted tenants and management networks.
# Example policy override tightening Portgroup read access in Ironic policy.yaml
# Applies to Ironic <= 38.0.0 as a temporary hardening measure
"baremetal:portgroup:get": "rule:is_member and (project_id:%(node.owner)s or project_id:%(node.lessee)s)"
"baremetal:portgroup:list": "rule:is_member and (project_id:%(node.owner)s or project_id:%(node.lessee)s)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
