OpenStack Ironic through version 38.0.0 contains an incorrect authorization vulnerability (CWE-863) where a project reader role can access Portgroup information assigned to Nodes belonging to other projects by sending a specially crafted request. This exposure violates project isolation and confidentiality principles within the Ironic service. The vulnerability is confirmed in multiple discrete versions (1.0.0, 30.0.0, 33.0.0, 36.0.0). No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with project reader privileges can gain unauthorized read access to Portgroup data assigned to Nodes of other projects. This could lead to information disclosure about infrastructure resources across project boundaries. There is no indication of impact on integrity or availability. The confidentiality breach is limited to metadata exposure within the OpenStack Ironic service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict project reader privileges carefully and monitor for unusual access patterns. Avoid granting project reader roles to untrusted users in environments where cross-project data confidentiality is critical.