Quick answers
- Is CVE-2026-74250 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-74250 being exploited in the wild.
- How severe is CVE-2026-74250?
- Medium severity, with a CVSS score of 6.3, published 14 August 2026.
- Which products and versions are affected?
- OpenStack Ironic before 38.0.1.
- Is there a fix for CVE-2026-74250?
- A patch was published on 2026-08-28: Fix merged to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-74250 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-74250?
- Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the autodetect deploy interface implementation, which silently bypasses (no-ops) step-based workflows such as cleaning when the interface has not yet delegated to a functional concrete deploy interface after enrollment. The root cause is that the autodetect interface lacks proper delegation before performing cleaning operations, and it does not fail or alert when such operations are attempted. Additionally, the interface incorrectly resets to a previous autodetect configuration when the deploy interface is changed via API while a node is in active states. The fix ensures explicit switching to a concrete interface before running step-based workflows and loudly fails if unimplemented methods are called; it also explicitly unsets the original_deploy_interface tracking variable when API calls explicitly change the deploy interface.
Affected products
- OpenStack Ironic before 38.0.1
Timeline
- 2026-08-14: disclosed
- 2026-08-28: patched: Fix merged to master branch