CVE-2026-74250 affects OpenStack Ironic prior to version 38.0.1. The vulnerability involves the autodetect deploy interface potentially failing to execute cleaning operations immediately after a node is enrolled or when the deploy interface is changed to autodetect. This failure could lead to nodes not being properly cleaned, which may affect the deployment lifecycle and system integrity. The CVSS 3.1 score is 6.3, indicating a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact but no impact on integrity or availability.

The vulnerability may cause the cleaning process to not run as expected, potentially leaving nodes in an unclean state after enrollment or interface changes. This could lead to confidentiality issues as indicated by the CVSS vector, but there is no direct impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor OpenStack Ironic vendor advisories for updates and consider workarounds or manual cleaning processes until a fix is available.