OpenStack Ironic before version 35.0.2 contains a weakness that permits a user with the project administrator or manager role to read arbitrary local files on the conductor through a PXE template. This leads to confidentiality loss of sensitive configuration or system data, as the vulnerability is a file read flaw classified as CWE-669. The impact is confined to information disclosure; there is no direct code execution or denial of service described.

Affected product is OpenStack Ironic, versions prior to 35.0.2. The vulnerability applies to all deployments that use the Ironic conductor component with default role assignments for project admins or managers.

The CVSS score of 4.9 indicates a moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is internal: an attacker must be authenticated with sufficient project privileges to modify or access a PXE template; no remote exploitation or unprivileged attack is implied. Exploitation requires the attacker to deliberately load a crafted template that references sensitive local paths, then retrieve them via the conductor service.