CVE-2026-71201

CVE-2026-71201 is a cross-tenant information disclosure in OpenStack Ironic where an authenticated user with reader privileges in one project can retrieve Portgroup objects bound to nodes belonging to a different project. The EPSS score of 0.00168 is almost certainly miscalibrated for this class of vulnerability in infrastructure-as-a-service contexts — the scoring model reflects historical exploit patterns that underweight silent, query-based data leaks which generate no anomalous traffic signature. The critical question for defenders: what does a Portgroup actually contain? In bare metal environments managed by Ironic, Portgroups define physical network topology — bonding configurations, VLAN assignments, and potentially MAC addresses. This is not arbitrary metadata; it describes infrastructure that took weeks to rack, cable, and provision. In a multi-tenant bare metal deployment (colocation, dedicated hosts, BMaaS), reconstructing another tenant's physical network architecture from a single authenticated request collapses the isolation guarantee tenants are paying for. The 'crafted request' language in the CVE signals an Insecure Direct Object Reference — likely a query scoping failure where Ironic's API returns results without properly filtering by project context at the persistence layer. The fix probably wasn't just adding a project filter; for leased nodes, the code likely had to reason about what trust boundary applies when a node transitions between projects. During lease transitions, there's a window where Portgroup bindings may not be fully rescoped, and historical configuration from a previous tenant could theoretically remain retrievable. Check three things in your deployment: whether Portgroup objects in your Ironic instance contain VLAN details, bonding configurations, or MAC addresses that would enable network reconstruction; whether the API audit logs show any cross-project Portgroup queries that succeeded unexpectedly; and whether your leased node lifecycle properly clears or re-scopes Portgroup bindings during state transitions. The CVSS of 5 treats this as generic information disclosure, but the blast radius in bare metal contexts — where topology is physically immutable — warrants treating this as higher priority than the score suggests.

Reviewed through automated stages and approved by a human before publication.