CVE-2026-44918
Description
A flaw was found in OpenStack Ironic. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node. This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on.
Statement
The Red Hat Product Security team has assessed the severity of this vulnerability as Important. An authenticated project manager can reparent Volume Connectors and Volume Targets to nodes in a different project, crossing project authorization boundaries and potentially exposing iSCSI secrets used for boot-from-volume configurations. However, exploitation requires the 'manager' role, which is not a default role in OpenStack and must be explicitly granted by an administrator. The attacker must also know the UUID of the target node in the other project. In Red Hat OpenStack Platform 18.0, the automatic_lessee feature defaults to false and did not function correctly; a properly working version was only introduced in upstream release 26.1.0 (gazpacho), which Red Hat does not ship. The parent/child node relationship capability, introduced in upstream Ironic 22.0.0, has never been shipped in any version of Red Hat OpenStack Platform or Red Hat OpenStack Services on OpenShift. These factors reduce the practical attack surface in Red Hat shipped configurations.
Mitigation
Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, ensuring the expected number of volume targets and volume connectors are present. Operators can also use the provided ironic-status upgrade check to identify misconfigured nodes.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.7 | N/A | 5.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Red Hat CVSS v3 Score Explanation
Scope changed from Unchanged to Changed per discussion with Julia Kreger (OpenStack Ironic PTL). The attacker operates within their own project but can access volume connectors and secrets belonging to a different project, crossing project authorization boundaries. PR kept as High per Julia: manager role is admin-scoped within project, and attacker needs UUID of target node (requiring access to the other project).
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Modify Memory; Read Memory; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity; Bypass Protection Mechanism; Other
Acknowledgements
Upstream acknowledges Julia Kreger (OpenStack) as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
