OpenStack Ironic before version 39.0.1 allows authenticated users with vendor_passthru privileges to execute HTTP DELETE and GET operations that target the Redfish service; an attacker can craft a subscription ID that exploits a path‑traversal flaw, enabling deletion of BMC Redfish accounts or reading arbitrary Redfish resources. This leads to loss of confidentiality and integrity for the Baseboard Management Controller since sensitive configuration data or credentials can be exposed or destroyed. The flaw is a classic path‑traversal vulnerability (CWE-22) with an additional control flow issue (CWE-1287).

OpenStack Ironic. No specific version information is provided, but the vulnerability affects the Redfish vendor passthrough subscription management component in all installations where this functionality is enabled.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available while the vulnerability is not listed in CISA KEV. Exploitation requires authenticated vendor_passthru privileges, so the attack vector is likely an insider or a compromised user; external unauthenticated attacks are not viable. Consequently, risk remains moderate, but it can be elevated in environments where the BMC holds critical firmware or configuration data. The absence of an EPSS score limits fine‑grained exploitation probability modeling, yet the CVSS rating points to a realistic chance of successful exploitation under suitable conditions.