In versions of OpenStack Ironic up to and including 38.0.0, a crafted request from a user with project reader privileges can cause the service to return portgroup information for nodes that belong to or are leased by other projects. This results in a confidentiality violation, leaking which network port groups are associated with resources that the requestor does not own. The weakness is an unauthorized information disclosure due to insufficient access‑control checks (CWE‑863).

OpenStack Ironic, all releases through 38.0.0. The vulnerability is present in the Ironic service regardless of environment configuration, affecting any installation that exposes the API to users with reader rights. No specific product version ranges beyond 38.0.0 were listed.

The CVSS score of 5 indicates moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV, so the publicly known exploitation likelihood is uncertain. The attack does not require elevated privileges; any project reader can issue the crafted request, which can be performed over the network to the Ironic API. Once executed, the attacker receives sensitive information about other projects’ portgroup assignments, potentially aiding further lateral movement or reconnaissance.