The vulnerability identified as CVE-2026-74250 affects OpenStack Ironic versions 32.0.0 and 36.0.0. It involves the autodetect deploy interface failing to execute cleaning operations immediately after enrollment or when switching to the autodetect deploy interface. This failure can lead to sensitive information remaining on resources that are reused, classified under CWE-226 (Sensitive Information in Resource Not Removed Before Reuse). The CVSS v3.1 score is 6.3, indicating a medium severity with network attack vector, high complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Sensitive information may remain on hardware resources managed by OpenStack Ironic due to the failure of the autodetect deploy interface to clean resources promptly. This could lead to unauthorized disclosure of sensitive data if the resource is reused without proper cleaning. The confidentiality impact is high, but integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor OpenStack advisories for updates and consider manual cleaning procedures after enrollment or interface changes as a precaution until a fix is available.