Skip to content

[release-4.19] OCPBUGS-100165: CVE-2026-44918: Prevent rehoming resources to nodes with different owner - #458

Open
rh-soboh wants to merge 1 commit into
openshift:release-4.19from
rh-soboh:CVE-2026-44918-4.19
Open

[release-4.19] OCPBUGS-100165: CVE-2026-44918: Prevent rehoming resources to nodes with different owner#458
rh-soboh wants to merge 1 commit into
openshift:release-4.19from
rh-soboh:CVE-2026-44918-4.19

Conversation

@rh-soboh

@rh-soboh rh-soboh commented Jul 29, 2026

Copy link
Copy Markdown

Summary

Backport upstream fix for CVE-2026-44918 / OSSA-2026-026 into release-4.19.

Prevents rehoming volume connectors/targets (and related parent/child and port resources) onto nodes with a different owner without re-checking access on the destination node.

Notes

  • Based on upstream stable/2025.1 commit 54e4cf7 (Change-Id Iaa512f380926a9fc032eefea5bcdcbc5040a4739).
  • Adapted for release-4.19 path layout (ironic/command vs ironic/cmd).
  • Raised flake8 max-complexity 20 → 21 for the new helper.
  • Upstream ironic-status parent/child owner upgrade-check hunk did not apply cleanly on this branch and was omitted; API RBAC hardening from the CVE fix is included.

Upstream

Jira

OCPBUGS-100165

@dtantsur @rh-soboh
CVE-2026-44918: Prevent rehoming resources to nodes with different owner
98c831e 
Ironic has a few similar patterns where only the source node is verified
during a create or update operation:
1. A node can be created with a parent from a different project
2. Node can be updated to have a parent from a different project
3. Ports, port groups, volume targets and volume connectors can be
   patched to be owned by a node from a different project.

This patch addresses all these cases and introduces a single helper to
cover all of them.

Also makes sure that baremetal:node:get is checked even if the parent
node ID is a UUID (it was missing before).

Related-Bug: 2150450
Change-Id: Iaa512f380926a9fc032eefea5bcdcbc5040a4739
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
Signed-off-by: Jay Faulkner <jay@jvf.cc>
(cherry picked from commit b58d4ad)
(cherry picked from commit d99b35d)
@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 29, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 29, 2026

Copy link
Copy Markdown

@rh-soboh: This pull request references Jira Issue OCPBUGS-100165, which is invalid:

  • release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
  • expected Jira Issue OCPBUGS-100165 to depend on a bug targeting a version in 4.20.0, 4.20.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Backport upstream fix for CVE-2026-44918 / OSSA-2026-026 into release-4.19.

Prevents rehoming volume connectors/targets (and related parent/child and port resources) onto nodes with a different owner without re-checking access on the destination node.

Notes

  • Based on upstream stable/2025.1 commit 54e4cf7 (Change-Id Iaa512f380926a9fc032eefea5bcdcbc5040a4739).
  • Adapted for release-4.19 path layout (ironic/command vs ironic/cmd).
  • Raised flake8 max-complexity 20 → 21 for the new helper.
  • Upstream ironic-status parent/child owner upgrade-check hunk did not apply cleanly on this branch and was omitted; API RBAC hardening from the CVE fix is included.

Upstream

Jira

OCPBUGS-100165

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@rh-soboh

rh-soboh commented Jul 29, 2026

Copy link
Copy Markdown
Author

/ok-to-test

@openshift-ci openshift-ci Bot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Jul 29, 2026
@openshift-ci
openshift-ci Bot requested review from iurygregory and zaneb July 29, 2026 14:45
@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown

@rh-soboh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@elfosardo

elfosardo commented Jul 31, 2026

Copy link
Copy Markdown

/approve
/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2026
@openshift-ci

openshift-ci Bot commented Jul 31, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: elfosardo, rh-soboh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iurygregory iurygregory Awaiting requested review from iurygregory
@zaneb zaneb Awaiting requested review from zaneb

Assignees

@elfosardo elfosardo

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@rh-soboh @openshift-ci-robot @elfosardo @dtantsur