A flaw was reported in Ironic:

Brad Morgan from Rackspace reported a vulnerability in Ironic. To prevent user data leak, Ironic is expected to "clean" a server after use, however that is transparently not happening. Previous tenant's data may be left behind on the disk and may be available to new users. All Ironic setups are affected.

This flaw is reported to affect versions >= 4.2.0 and <= 4.2.1.

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brad Morgan from Rackspace as the original reporter.