https://seclists.org/oss-sec/2026/q4/309: [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419)
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
Openstack Ironic
Frequently Asked Questions
1
Which users can change a node's maintenance state under the default Ironic policy?
A user with the member role on the project identified by node.lessee can change the maintenance setting. This access is typically restricted to manager or admin roles on lessee accounts.
2
What API request path causes the weaker authorization check?
An HTTP PATCH request to /v1/nodes/{ident} that includes maintenance or maintenance_reason is evaluated against the baremetal:node:update policy. The dedicated /v1/nodes/{ident}/maintenance API applies the separate set_maintenance and clear_maintenance policies.