OSSA-2026-048: Ironic allows generic node update for maintenance setting

Date:

October 22, 2026

CVE:

CVE-2026-89419

Affects

  • Ironic: >=17.0.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0 <=39.0.1

Description

The Metal3.io Security team reported a vulnerability in Ironic’s API. When calling the Node maintenance API at /v1/nodes/{ident}/maintenance, Ironic properly applies the baremetal:node:set_maintenance and baremetal:node:clear_maintenance policies.

However, if a user instead calls the more generic Node update API by sending an HTTP PATCH to /v1/nodes/{ident}, and includes maintenance or maintenance_reason in the dictionary, they can instead trigger the baremetal:node:update policy. This may lead to users unexpectedly having access to change the maintenance setting on a node.

For clouds using default Ironic policy, this means someone with the member role on the project indicated in node.lessee can change maintenance on the node. This is typically restricted only to accounts with manager or admin roles on lessee accounts. There is no change in effective default permissions in the case of node.owner project members or system-scoped users.

Patches

Credits

  • Tuomo Tanskanen, Metal3.io Security Team from Ericsson Software Technology (CVE-2026-89419)

  • Dmitry Tantsur, Metal3.io Security Team from Red Hat (CVE-2026-89419)

References

Notes

  • Patches for unmaintained/2024.1, bugfix/38.0, and bugfix/37.0 will be merged to git but no new release will be provided.