High [CVE-2026-44918] Prevent rehoming resources to nodes with different owner
This high-severity Red Hat Linux advisory covers CVE-2026-44918 affecting Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object.
Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node.
This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on. The Red Hat Product Security team has assessed the severity of this vulnerability as Important.
An authenticated project manager can reparent Volume Connectors and Volume Targets to nodes in a different project, crossing project authorization boundaries and potentially exposing iSCSI secrets used for boot-from-volume configurations.
However, exploitation requires the 'manager' role, which is not a default role in OpenStack and must be explicitly granted by an administrator. The attacker must also know the UUID of the target node in the other project.
- < 37.0.1
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
- openshift4/ose-ironic-rhel9:1786494073
- openshift4/ose-ironic-rhel9:1786573036
- openshift4/ose-ironic-rhel9:1785883416
- RHSA-2026:54583
- RHSA-2026:54602
- RHSA-2026:51038
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, ensuring the expected number of volume targets and volume connectors are present. Operators can also use the provided ironic-status upgrade check to identify misconfigured nodes.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.