OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident}, bypassing the specific maintenance endpoint and the intended stricter set_maintenance policy. This bypass flaws the intended role boundary (CWE‑862) and permits an authenticated user to place nodes into or out of maintenance. Based on inference, the specific role required for the attacker is not explicitly specified in the data, so it likely involves a user with sufficient privileges to modify node attributes. The resulting state changes can disrupt scheduling, lead to service availability problems, and negate operator‑initiated maintenance actions.

OpenStack Ironic, the bare‑metal provisioning component of the OpenStack platform. No specific version information is provided in the available data.

The CVSS score of 5 indicates moderate severity. No EPSS data is supplied; the vulnerability does not appear in CISA’s KEV catalog. It likely requires authenticated access, but the exact role is not specified in the CVE description, so the threat appears to be an insider or credential‑reuse activity rather than a remote unauthenticated exploit. Once executed, the vulnerability can cause service disruption but does not provide direct code‑execution or data‑exfiltration capabilities. The risk is therefore moderate with potential availability impact, especially in environments where maintenance mode is critical for scheduling or security compliance.