High [CVE-2026-44918] Prevent rehoming resources to nodes with different owner

OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object.

Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node.

This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on. The Red Hat Product Security team has assessed the severity of this vulnerability as Important.

An authenticated project manager can reparent Volume Connectors and Volume Targets to nodes in a different project, crossing project authorization boundaries and potentially exposing iSCSI secrets used for boot-from-volume configurations.

However, exploitation requires the 'manager' role, which is not a default role in OpenStack and must be explicitly granted by an administrator. The attacker must also know the UUID of the target node in the other project.