Executive brief
OpenStack Ironic is a bare-metal provisioning service that manages the deployment and lifecycle of physical servers. When configured to autodetect the deployment interface, Ironic incorrectly skips node cleaning operations after enrollment or interface changes, potentially allowing nodes to reach production without proper initialization. This could leave bare-metal systems in an inconsistent or insecure state.
Technical details
The vulnerability exists in the autodetect deploy interface implementation, which silently bypasses (no-ops) step-based workflows such as cleaning when the interface has not yet delegated to a functional concrete deploy interface after enrollment. The root cause is that the autodetect interface lacks proper delegation before performing cleaning operations, and it does not fail or alert when such operations are attempted. Additionally, the interface incorrectly resets to a previous autodetect configuration when the deploy interface is changed via API while a node is in active states. The fix ensures explicit switching to a concrete interface before running step-based workflows and loudly fails if unimplemented methods are called; it also explicitly unsets the original_deploy_interface tracking variable when API calls explicitly change the deploy interface.
Affected products
- OpenStack Ironic before 38.0.1
Timeline
- 2026-08-14: disclosed
- 2026-08-28: patched: Fix merged to master branch