CVE-2026-44918: OpenStack Ironic Cross-Project Node Manipulation Vulnerability

Technical summary

CVE-2026-44918 is a missing authorization vulnerability (CWE-862) in OpenStack Ironic versions prior to 37.0.1. The vulnerability stems from insufficient enforcement of project isolation when creating or modifying node records. A user with high-level privileges can bypass project-level access boundaries and manipulate nodes across project boundaries. The flaw is network-accessible, requires high-level privileges (PR:H), and does not require user interaction. Impact is primarily informational confidentiality (C:H) with limited integrity risk (I:L) to node configuration, and no availability impact.

Business impact

Organizations operating multi-tenant OpenStack environments risk tenant isolation failures. Cross-project node manipulation could allow one tenant's administrators to reconfigure or claim bare metal hardware designated for another tenant, leading to service disruption for affected projects, loss of compute capacity, and potential data residency compliance violations if workloads are redirected across unauthorized boundaries. In shared infrastructure scenarios, this undermines the trust model and SLA guarantees between customers.

Affected systems

OpenStack Ironic deployments before version 37.0.1 are affected. The vulnerability applies to all configurations where Ironic manages bare metal nodes in multi-project environments. No vendor-specific product variants or downstream distributions are listed in current advisories; however, operators should verify whether their deployment includes any vendor-customized or forked versions of Ironic and check with their support channel for patched versions.

Exploitability

Exploitation requires high-level administrative or service credentials within an OpenStack deployment. An attacker cannot exploit this remotely without first obtaining privileged access. Once authenticated with such privileges, the vulnerability can be exploited via standard OpenStack API calls without additional complexity or user interaction. The likelihood of exploitation is directly tied to credential compromise or insider threat scenarios rather than random opportunistic attacks.

Remediation

Upgrade OpenStack Ironic to version 37.0.1 or later. Operators unable to upgrade immediately should review and enforce strict role-based access control (RBAC) policies, audit recent node creation and modification logs for cross-project activity, and consider network segmentation or API gateway controls to restrict Ironic API access to trusted administrative sources only.

Patch guidance

Verify the availability of OpenStack Ironic 37.0.1 or a later patched release from your OpenStack distribution or vendor. Follow your organization's change management process for applying the patch, which typically involves testing in a non-production environment first, scheduling maintenance windows, and restarting affected Ironic conductor services. Consult the OpenStack release notes and vendor security advisories for any additional configuration changes or known issues introduced in the patched version.

Detection guidance

Monitor Ironic API audit logs for CreateNode and UpdateNode operations that reference project IDs different from the authenticated user's primary project assignment. Alert on any successful cross-project node modifications. Review historical audit trails for the period between the vulnerability's public disclosure (July 10, 2026) and your patch deployment to identify unauthorized cross-project activity. If audit logging is not enabled, prioritize enabling it before or immediately after patching.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), this vulnerability should be prioritized in multi-tenant environments because it directly undermines project isolation—a foundational security assumption in OpenStack. The requirement for high-level privileges limits the attack surface, but compromised service accounts, insider threats, or supply chain compromises could enable rapid exploitation across multiple tenants. Organizations with strict data residency, compliance, or multi-customer separation requirements should treat this as higher priority than the base score suggests.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), and the need for high-level privileges (PR:H) to exploit the flaw. High confidentiality impact (C:H) reflects the ability to view and manipulate node configuration and metadata across projects. Limited integrity impact (I:L) acknowledges that node modification is possible but does not directly corrupt or delete data. No availability impact (A:N) is assigned because the vulnerability does not inherently cause service disruption or denial of access. The score is tempered by the privilege requirement, making it suitable for MEDIUM severity rather than HIGH.

Frequently asked questions