An incorrect resource transfer vulnerability in OpenStack Ironic allows low privileged users to leak sensitive authentication tokens to remote endpoints, presenting a high risk of unauthorized data access.

This is an incorrect resource transfer between spheres flaw where an authenticated user invoking molds can request authorization to be sent to a remote endpoint, requiring low privileges and no user interaction.

A successful exploit exposes time limited Keystone tokens or basic storage credentials to external endpoints, granting attackers access to all OpenStack services authorized by the leaked token. This compromises confidentiality across the cloud environment, potentially leading to widespread data theft. The CVSS score of 7.7 reflects the high severity of potential information disclosure across managed resources.

Immediate Action: Update OpenStack Ironic and ironic-python-agent to version 26.1.6, 29.0.5, 32.0.1, 35.0.1, or later depending on your deployment branch.

Proactive Monitoring: Monitor network traffic from Ironic services for unexpected outbound connections to external endpoints, and audit Keystone token usage logs for anomalous access patterns.

Compensating Controls: Implement strict egress filtering and firewall rules on Ironic management nodes to prevent unauthorized outbound communication to untrusted external destinations.

Public Exploit Available: false

Given the high severity score and the potential for widespread administrative credential theft, administrators should prioritize updating OpenStack Ironic packages. Apply the vendor supplied patches immediately to secure credential handling during mold imports and prevent potential token exfiltration.