What is the CVSS score of CVE-2026-44918?

CVE-2026-44918 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of OpenStack Ironic are affected by CVE-2026-44918?

OpenStack Ironic (CVE-2026-44918) contains an access control bypass that allows authenticated users to retrieve iSCSI storage credentials and access resources across node boundaries, creating a…. A patch is available.

How to fix or mitigate CVE-2026-44918?

24 hours: Audit Ironic API audit logs for suspicious cross-node access patterns to Volume Targets, Volume Connectors, Port, and Portgroup objects; identify users with excessive resource permissions; initiate immediate rotation of iSCSI credentials. 7 days: Implement network-level access restrictions to Ironic API endpoints; enforce multi-factor authentication for all Ironic administrative accounts; deploy monitoring and alerting for unauthorized resource access attempts. 30 days: Subscribe to OpenStack security advisory feeds; evaluate feasibility of implementing namespace isolation or RBAC hardening at the orchestration layer; plan for Ironic version upgrade when patches become available.

OpenStack Ironic CVE-2026-44918

EUVD-2026-42777 MEDIUM

Missing Authorization (CWE-862)

2026-07-08

GHSA-q458-5jc4-vvpg

Authentication Bypass Red Hat

5.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network API access with existing low-privileged credentials; high confidentiality impact due to iSCSI credential exposure in affected configurations; limited integrity impact on Port/Portgroup objects; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 05:01 EUVD

CVSS changed

Jul 10, 2026 - 04:22 NVD

5.5 (MEDIUM)

Analysis Generated

Jul 08, 2026 - 16:50 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Insufficient access controls in OpenStack Ironic's parent/child node hierarchy allow authenticated users to access or manipulate resources belonging to nodes outside their authorization scope. Affected objects include Volume Targets and Volume Connectors - which carry iSCSI storage credentials in boot-from-volume deployments - as well as Port and Portgroup objects (hardened as defense-in-depth in the same patch set). No public exploit identified at time of analysis and the CVE carries no CVSS score in the input data, but the exposure of iSCSI credentials in affected environments represents a meaningful lateral-movement risk within bare-metal cloud infrastructure.

Technical ContextAI

OpenStack Ironic is the bare-metal provisioning service within the OpenStack ecosystem, responsible for enrolling, managing, and deploying physical servers via IPMI, PXE, and iSCSI. Ironic organizes nodes in parent/child relationships, allowing hierarchical management of chassis and blade systems. The flaw lies in the API access control layer, which fails to enforce proper authorization checks when a requester traverses parent/child node boundaries to operate on Volume Targets, Volume Connectors, Ports, or Portgroups owned by a different node. In iSCSI boot-from-volume configurations, Volume Targets and Connectors store storage initiator/target credentials, making unauthorized read access a credential-theft vector. No CWE was assigned in the input data, but the root-cause class is consistent with CWE-284 (Improper Access Control) or CWE-639 (Authorization Bypass Through User-Controlled Key). Affected branches span 2025.1/epoxy through 2026.2/hibiscus and Bugfix branches 33.0, 34.0, and 37.0.

RemediationAI

Apply the upstream patches corresponding to the deployed Ironic branch via the Gerrit review links in the advisory: 996478 (epoxy), 996476 (flamingo), 996469 (gazpacho), 996462 (hibiscus), 996474 (Bugfix/33.0), 996471 (Bugfix/34.0), 996464 (Bugfix/37.0). Note that Bugfix branches receive git patches only - no updated release packages will be published for those branches, so operators must build from source or apply patches manually. For environments that cannot patch immediately and that use boot-from-volume with iSCSI, the most effective compensating control is to restrict Ironic API access to a single trusted administrative service account rather than allowing per-project operator access, thereby eliminating the cross-node authorization path until patching is complete. Operators using only local-disk or non-iSCSI boot methods face no sensitive credential exposure from this flaw and can treat patching as standard maintenance priority. The 2024.1/caracal branch is unmaintained; operators on that release should upgrade to a supported branch.