OpenStack Ironic Insufficient Access Controls CVE-2026-44918

Vulnerability Overview Vulnerability Name: OSA-2026-026: Insufficient Access Controls in Ironic regarding Parent/Child Nodes Release Date: July 8, 2026 CVE ID: CVE-2026-44918 Description: This vulnerability involves multiple related issues within Ironic's RBAC. An authorized project manager can change nodes associated with Volume Connectors or Volume Target objects, thereby altering the permissions allowed for access. Volume Connectors contain secret information used in environments configured for booting from volumes. This issue is tracked as bug #2150256. Impact: Objects that were not correctly detected can be discovered by inspecting the data. Operators should perform basic audits to ensure that the expected number of volume targets and volume connectors exist. Additionally, project managers with node creation permissions can create a node using the UUID of a node that does not belong to their project as the parent node. This mismatched parent node can be used to influence operations, such as forcing a power-on action. This issue is tracked as bug #2150450. Affected Versions Affected Versions: - Ironic: >=27.0.0 =30.0.0 =33.0.0 =36.0.0 <37.0.1 Remediation Patch Links: - https://review.opendev.org/c/openstack/ironic/+/996479 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/996478 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/996476 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/996469 (2025.1/patchpool) - https://review.opendev.org/c/openstack/ironic/+/996462 (2025.2/hibiscus) - https://review.opendev.org/c/openstack/ironic/+/996474 (Bugfix/33.6) - https://review.opendev.org/c/openstack/ironic/+/996471 (Bugfix/34.6) - https://review.opendev.org/c/openstack/ironic/+/996464 (Bugfix/37.6) Reference Links: - https://bugs.launchpad.net/ironic/+bug/2150256 - https://bugs.launchpad.net/ironic/+bug/2150450 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44918 Notes Volume Targets and Volume Connectors contain sensitive information only in environments configured for booting from volumes. These patches also include hard logic to prevent such vulnerabilities from occurring in Port and Portgroup objects. This is a defensive measure providing consistent errors at the API level. The 2024.1/caracal branch is unmaintained, and the patch is provided as a courtesy. Bugfix branches will receive the patch in git but will not receive updated versions. Additional Information Download Attachment: "OpenPGP_signature.asc" with type "application/pgp-signature" (496 bytes) Mailing List: Please refer to the Open Source Software Security Wiki, which is the counterpart to this mailing list. Mailing List Usage: If you are confused about the mailing list and its usage, please read the mailing list guide on Wikipedia and review the guidelines on proper message formatting.

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Ironic Insufficient Access Controls CVE-2026-44918