Junglewise Threat Intelligence

CVE-2026-44918: OpenStack Ironic missing authorization in cross-project node operations

CVE-2026-44918 · Severity: medium · CVSS 5.5 · Published 2026-07-10

Technologies: OpenStack Ironic. Vendors: OpenStack.

Executive brief

OpenStack Ironic, a service for managing bare metal hardware, contains a security flaw in how it handles permissions between different projects. An authorized user in one project could potentially view or modify hardware resources belonging to a different project by exploiting a lack of validation in parent-child relationships between nodes. This could lead to unauthorized access to sensitive volume connection secrets or allow a user to interfere with the power state and deployment operations of another project's servers.

Technical details

A missing authorization vulnerability (CWE-862) in OpenStack Ironic allows authenticated project managers to perform cross-project operations. Specifically, an attacker can create a new node and assign it a parent UUID belonging to a different project, or modify Volume Connectors and Volume Target objects to associate them with nodes in different projects. This occurs because Ironic failed to validate that the 'node.owner' values matched between parent and child entities. Exploitation can lead to the exposure of iSCSI volume secrets or the ability to disrupt parent node operations (e.g., preventing power-off or triggering unauthorized power-on). Fixes have been released in versions 29.0.6, 32.0.2, 35.0.2, and 37.0.1, which include mandatory owner matching and upgrade checks.

Affected products

  • OpenStack Ironic >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1

Timeline

  • 2026-04-27: disclosed: Bug reported to Launchpad by Dmitry Tantsur
  • 2026-07-08: advisory: OpenStack Security Advisory OSSA-2026-026 published
  • 2026-07-08: patched: Fixes released across multiple supported branches
  • 2026-07-10: advisory: CVE-2026-44918 published to NVD

References

Related threats