OpenStack Ironic versions up to 38.0.0 contain a CWE-923 vulnerability involving improper restriction of communication channels. Specifically, when the Image Service is configured for HTTP(S) Basic Authentication, Ironic may send credentials (username and password) to an unexpected remote host, potentially exposing sensitive authentication information. This issue affects multiple version ranges: from 24.0.0 through 29.0.6, 30.0.0 through 32.0.1, 33.0.0 through 35.0.1, and 36.0.0 through 38.0.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact.

The vulnerability can lead to the exposure of sensitive credentials (username and password) to unintended remote hosts, which could compromise authentication security. However, there is no indication of integrity or availability impact. No known exploits are reported in the wild.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the OpenStack vendor advisory for current remediation guidance. Until a fix is applied, avoid configuring the Image Service with HTTP(S) Basic Authentication or restrict network access to trusted endpoints to minimize exposure.