The vulnerability in OpenStack Ironic Python Agent allows a malicious bootc container, when deployed, to read the credentials used to download it via access to /proc/1/root. This defiles the confidentiality of those credentials, resulting in sensitive data leakage. The weakness aligns with CWE‑522, Sensitive Data Exposure, because the system fails to protect credential confidentiality during container deployment.

OpenStack Ironic Python Agent, all releases up to and including 11.5.0. Deploying bootc containers with these versions exposes the credentials needed for image retrieval. Any environment using these versions with bootc deployments is affected.

Based on the description, the likely attack vector is inferred to require the attacker to supply a malicious bootc container to the Ironic Python Agent; successful exploitation would only occur once the container is deployed, allowing it to read the credentials for downloading the image from /proc/1/root. This estimation of attack vector is derived from the fact that the vulnerability exposes credentials during container deployment and that only a container payload can trigger the read. The CVSS score of 5.5 indicates moderate severity, the EPSS score of <1% implies a low probability of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because the attacker must control the deployment process or have the ability to submit containers, the overall risk remains moderate but is limited to environments that use vulnerable agent versions for bootc deployments.