CVE-2026-44918 Missing authorization in Ironic
Attackers can create or modify nodes across projects without authorization, compromising infrastructure integrity in OpenStack Ironic deployments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44918?
CVE-2026-44918 is a medium-severity missing authorization vulnerability in OpenStack Ironic, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
Weakness: CWE-862
Which versions are affected by CVE-2026-44918?
How do I fix CVE-2026-44918?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44918 being exploited?
There is no known exploitation of CVE-2026-44918 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-44918, GHSA-q458-5jc4-vvpg, UBUNTU-CVE-2026-44918.