OpenStack Ironic versions prior to 37.0.1 contain a missing authorization vulnerability (CWE-862) that permits users with high privileges to create or modify nodes belonging to other projects without proper authorization. The vulnerability affects the management of bare metal nodes, potentially allowing unauthorized cross-project access and modification. The CVSS 3.1 base score is 5.5 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with high privileges in OpenStack Ironic can create or modify nodes across different projects without proper authorization, potentially leading to unauthorized disclosure or alteration of node information. This impacts confidentiality significantly and integrity to a lesser extent, but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the OpenStack vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege access to trusted administrators only and monitor for unauthorized cross-project node modifications.