Read the docs
TI-2026-52035 Aliases CVE-2026-74250GHSA-5j9p-9q2x-wxjm

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run…

Priority LOW 28CWE-226Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Partial Ironic (OpenStack): 35.0.2, 38.0.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackIronic32.0.0 to before 35.0.2; 36.0.0 to before 38.0.135.0.2, 38.0.1Patch availableCNA
  • Ironic VendorOpenStack Affected 32.0.0 to before 35.0.2; 36.0.0 to before 38.0.1 Fixed in 35.0.2, 38.0.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*——OpenStack
  • cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* Versions — — ·OpenStack

Remediation

  • Fix · CNA Ironic (OpenStack) Fixed in 35.0.2, 38.0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74250
  2. 2026-10-03 Alias added: GHSA-5j9p-9q2x-wxjm

References

Other 1

  • TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
  • TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
  • TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
  • TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
  • TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
  • TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
See all 332 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences