Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T15:00:00 openstack-ironic: Prevent rehoming resources to nodes with different owner 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CWE-1220

OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.

A flaw was found in OpenStack Ironic. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node. This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on.

The Red Hat Product Security team has assessed the severity of this vulnerability as Important. An authenticated project manager can reparent Volume Connectors and Volume Targets to nodes in a different project, crossing project authorization boundaries and potentially exposing iSCSI secrets used for boot-from-volume configurations. However, exploitation requires the 'manager' role, which is not a default role in OpenStack and must be explicitly granted by an administrator. The attacker must also know the UUID of the target node in the other project. In Red Hat OpenStack Platform 18.0, the automatic_lessee feature defaults to false and did not function correctly; a properly working version was only introduced in upstream release 26.1.0 (gazpacho), which Red Hat does not ship. The parent/child node relationship capability, introduced in upstream Ironic 22.0.0, has never been shipped in any version of Red Hat OpenStack Platform or Red Hat OpenStack Services on OpenShift. These factors reduce the practical attack surface in Red Hat shipped configurations. Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, ensuring the expected number of volume targets and volume connectors are present. Operators can also use the provided ironic-status upgrade check to identify misconfigured nodes. Red Hat OpenShift Container Platform 4 Affected openstack-ironic Red Hat OpenStack Platform 16.2 Not affected openstack-ironic Red Hat OpenStack Platform 17.1 Affected openstack-ironic Red Hat OpenStack Platform 18.0 Affected openstack-ironic https://www.cve.org/CVERecord?id=CVE-2026-44918 https://nvd.nist.gov/vuln/detail/CVE-2026-44918 https://launchpad.net/bugs/2150256 https://launchpad.net/bugs/2150450