CVE-2026-44918 Overview
CVE-2026-44918 is a missing authorization vulnerability [CWE-862] in OpenStack Ironic, the bare metal provisioning service. Versions before 37.0.1 permit authenticated users to create or modify nodes across project boundaries without proper authorization checks. An attacker with valid credentials in one project can manipulate Ironic nodes owned by other projects. This breaks the tenant isolation model that OpenStack deployments depend on for multi-tenant security. The issue is tracked in OSSA-2026-026 and was disclosed publicly through the OpenStack announcement thread.
Critical Impact
Authenticated attackers can create or modify bare metal nodes belonging to other OpenStack projects, breaking tenant isolation in multi-tenant cloud environments.
Affected Products
- OpenStack Ironic versions before 37.0.1
- OpenStack deployments using Ironic bare metal provisioning
- Multi-tenant OpenStack clouds with Ironic-managed hardware
Discovery Timeline
- 2026-07-08 - Public disclosure via OpenWall OSS Security
- 2026-07-10 - CVE-2026-44918 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-44918
Vulnerability Analysis
OpenStack Ironic manages bare metal servers as a compute resource, exposing REST APIs for node lifecycle operations. The vulnerability stems from missing authorization enforcement on node creation and modification endpoints. The service fails to validate that the requesting user's project scope matches the target node's owning project.
This breaks the RBAC (Role-Based Access Control) model OpenStack uses for tenant separation. An authenticated user with node-management permissions in their own project can invoke Ironic APIs against nodes in other projects. The consequences include unauthorized hardware provisioning, disruption of other tenants' bare metal workloads, and potential lateral movement into physical infrastructure managed by other teams.
The Launchpad bug report tracks the underlying defect. The fix landed in Ironic 37.0.1.
Root Cause
The root cause is a missing project-scope check [CWE-862] in the Ironic node API handlers. Authorization policies verify that the caller holds appropriate roles but do not verify that the target node belongs to the caller's project. This class of flaw is common where object-level authorization is decoupled from operation-level authorization.
Attack Vector
Exploitation requires network access to the Ironic API and valid credentials with high privileges in some OpenStack project. The attacker sends node create or update requests referencing nodes owned by other projects. Because the service does not enforce cross-project restrictions, the operations succeed. No user interaction is required and attack complexity is low.
See the OpenStack Security Advisory OSSA-2026-026 for technical details on the vulnerable code paths.
Detection Methods for CVE-2026-44918
Indicators of Compromise
- Ironic API log entries showing node create or update operations where the requesting project ID does not match the target node's owner project ID
- Unexpected changes to node properties, driver_info, or instance_info fields on nodes not owned by the requesting tenant
- Keystone tokens from one project being used against Ironic node endpoints referencing UUIDs from other projects
Detection Strategies
- Correlate Keystone project context with Ironic node ownership in API access logs to flag cross-project operations
- Enable Ironic notifications and audit middleware to capture baremetal.node.update and baremetal.node.create events with actor and target project metadata
- Baseline normal per-project node modification patterns and alert on deviations, especially bursts of node changes from a single non-admin project
Monitoring Recommendations
- Forward Ironic and Keystone logs to a centralized SIEM with OCSF-normalized schemas for cross-service correlation
- Alert on any HTTP POST or PATCH to /v1/nodes where the authenticated project ID differs from the node's owner attribute
- Monitor bare metal state transitions (provision_state, power_state) for nodes that change outside of expected orchestration workflows
How to Mitigate CVE-2026-44918
Immediate Actions Required
- Upgrade OpenStack Ironic to version 37.0.1 or later as specified in OSSA-2026-026
- Audit Ironic API logs since deployment for any cross-project node modifications and validate node ownership integrity
- Restrict network access to the Ironic API endpoint to trusted management networks only
Patch Information
The fix is available in OpenStack Ironic 37.0.1. Operators should follow the standard OpenStack upgrade procedure for their distribution. Consult the OpenStack announcement thread and vendor-specific advisories from Red Hat, Canonical, and SUSE for backported patches to supported OpenStack releases.
Workarounds
- Tighten Ironic policy.yaml rules to restrict node create and update operations to the admin role or a dedicated bare metal service account until patching is complete
- Remove or scope down baremetal:node:update and baremetal:node:create permissions from non-privileged project roles
- Deploy API gateway or WAF rules that inspect request bodies and reject node references outside the caller's project scope
# Example Ironic policy.yaml hardening (interim workaround)
"baremetal:node:create": "rule:admin_api"
"baremetal:node:update": "rule:admin_api"
"baremetal:node:update_owner_provisioned": "rule:admin_api"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
