This vulnerability (CWE-226) affects OpenStack Ironic versions prior to 38.0.1. The issue occurs because the autodetect deploy interface may not trigger the cleaning process immediately after a node is enrolled or when the deploy interface is changed to autodetect. As a result, sensitive information from previous deployments may remain on the node, potentially exposing it to unauthorized access. The CVSS 3.1 base score is 6.3 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Sensitive information from previous deployments may remain on hardware nodes due to failure to clean immediately after enrollment or interface change. This could lead to unauthorized disclosure of sensitive data. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided and remediation level is null, users should monitor OpenStack advisories for updates. Until a fix is available, avoid using the autodetect deploy interface immediately after enrollment or interface changes, or implement manual cleaning procedures to ensure sensitive data is removed.