# CVE-2026-44918: OpenStack Ironic missing authorization in cross-project node operations

Source: https://junglewise.ai/threats/cve-2026-44918-openstack-ironic-missing-authorization-in-cross-project-node  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-44918 · Severity: medium · CVSS 5.5 · Published 2026-07-10

OpenStack Ironic, a service for managing bare metal hardware, contains a security flaw in how it handles permissions between different projects. An authorized user in one project could potentially view or modify hardware resources belonging to a different project by exploiting a lack of validation in parent-child relationships between nodes. This could lead to unauthorized access to sensitive volume connection secrets or allow a user to interfere with the power state and deployment operations of another project's servers.

Technologies: [OpenStack Ironic](https://junglewise.ai/threats/technologies/ironic). Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack).

## Quick answers

**Is CVE-2026-44918 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44918 being exploited in the wild.

**How severe is CVE-2026-44918?** Medium severity, with a CVSS score of 5.5, published 10 July 2026.

**Which products and versions are affected?** OpenStack Ironic >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1.

**Is there a fix for CVE-2026-44918?** A patch was published on 2026-07-08: Fixes released across multiple supported branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44918 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44918?** Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) in OpenStack Ironic allows authenticated project managers to perform cross-project operations. Specifically, an attacker can create a new node and assign it a parent UUID belonging to a different project, or modify Volume Connectors and Volume Target objects to associate them with nodes in different projects. This occurs because Ironic failed to validate that the 'node.owner' values matched between parent and child entities. Exploitation can lead to the exposure of iSCSI volume secrets or the ability to disrupt parent node operations (e.g., preventing power-off or triggering unauthorized power-on). Fixes have been released in versions 29.0.6, 32.0.2, 35.0.2, and 37.0.1, which include mandatory owner matching and upgrade checks.

## Affected products

- OpenStack Ironic >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1

## Timeline

- 2026-04-27: disclosed: Bug reported to Launchpad by Dmitry Tantsur
- 2026-07-08: advisory: OpenStack Security Advisory OSSA-2026-026 published
- 2026-07-08: patched: Fixes released across multiple supported branches
- 2026-07-10: advisory: CVE-2026-44918 published to NVD

## References

- [https://bugs.launchpad.net/ironic/+bug/2150450](https://bugs.launchpad.net/ironic/+bug/2150450)
- [https://lists.openstack.org/archives/list/openstack-announce@lists.openstack.org/thread/PAJKDWS23MKSSNX22JEVDA7RWN3BHJYC/](https://lists.openstack.org/archives/list/openstack-announce@lists.openstack.org/thread/PAJKDWS23MKSSNX22JEVDA7RWN3BHJYC/)
- [https://security.openstack.org/ossa/OSSA-2026-026.html](https://security.openstack.org/ossa/OSSA-2026-026.html)
- [https://www.openwall.com/lists/oss-security/2026/07/08/4](https://www.openwall.com/lists/oss-security/2026/07/08/4)
- [http://www.openwall.com/lists/oss-security/2026/07/08/4](http://www.openwall.com/lists/oss-security/2026/07/08/4)

## Related threats

- [OpenStack Ironic path injection in Redfish vendor_passthru](https://junglewise.ai/threats/cve-2026-90458-openstack-ironic-before-39-0-1-allows-delete-and-get-via-vendor)
- [OpenStack Ironic authorization bypass in node maintenance setting](https://junglewise.ai/threats/cve-2026-89419-openstack-ironic-before-39-0-1-sometimes-allows-a-user-to-change)
- [OpenStack Ironic denial of service via gzip bomb in configdrive](https://junglewise.ai/threats/cve-2026-115638-openstack-ironic-through-39-0-1-allows-a-denial-of-service-via-a)
- [OpenStack Ironic credential leakage in HTTP Basic Authentication](https://junglewise.ai/threats/cve-2026-90461-openstack-ironic-credential-leakage-in-http-basic-authentication)
- [OpenStack Ironic autodetect deploy interface cleaning bypass](https://junglewise.ai/threats/cve-2026-74250-openstack-ironic-autodetect-deploy-interface-cleaning-bypass)