OpenStack Ironic prior to version 37.0.1 permits unauthorized cross-project creation or modification of nodes. This vulnerability allows an attacker with high privileges to perform actions affecting node resources beyond their authorized project boundaries. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) indicates the attack can be performed remotely over the network with low complexity but requires high privileges. Confidentiality impact is high, integrity impact is low, and availability is not affected. Multiple Ubuntu package versions of Ironic are affected, spanning Ubuntu 16.04 LTS through Ubuntu 26.04 LTS releases. No vendor advisory or patch information is included, so patch status is not confirmed.

An attacker with high privileges can create or modify nodes in OpenStack Ironic across project boundaries without authorization, potentially leading to unauthorized access to sensitive information (high confidentiality impact) and limited integrity impact. Availability is not affected. This could compromise project isolation in multi-tenant environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor channels for updates and consider restricting high-privilege access until a fix is available.