{}

{}

{}

{"acknowledgement": "Upstream acknowledges Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) as the original reporters.", "bugzilla": {"description": "openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH", "id": "2550542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550542"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in OpenStack Ironic. A missing authorization check in the node PATCH API allows an authenticated lessee member to change the maintenance state of a bare metal node, an operation that should be restricted to lessee managers and administrators. By sending a PATCH request to /v1/nodes/{ident} with a maintenance field, the request is processed under the generic node-update policy rather than the stricter set_maintenance policy, bypassing the intended role boundary. This could allow a lessee member to place nodes into maintenance (disrupting scheduling and availability) or to clear maintenance mode on nodes an operator intentionally marked as under maintenance."], "mitigation": {"lang": "en:us", "value": "There is no practical operational or policy workaround for this issue. Upgrade to a fixed Ironic build when available. Until a fix is applied, maintenance toggled through this path can block power management and workflow request actions on affected nodes until maintenance is cleared by a user with appropriate access."}, "name": "CVE-2026-89419", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-ironic-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-10-22T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89419\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89419\nhttps://launchpad.net/bugs/2166510"], "statement": "This vulnerability is rated Moderate because an authenticated project member who already has general node update access can toggle maintenance through the PATCH API (PR:L under default Ironic policy) without going through the dedicated maintenance endpoints that enforce stricter roles. Practical impact is mild: the main effect is operational inconvenience, including blocking power management and workflow request actions on the node until maintenance is cleared. There is no confidentiality impact and no arbitrary code execution.\nThe attack path applies where OpenStack Ironic is used with Keystone and project-scoped RBAC, including Red Hat OpenStack Platform and deployments that run OpenStack on OpenShift with that authorization model. OpenShift Container Platform does not use OpenStack Keystone or project-scoped lessee RBAC in any configuration; the described privilege gap does not apply to default OpenShift bare-metal Ironic in the same way. The issue remains relevant for customers deploying OpenStack on OpenShift and for RHOSP environments that grant project members general node update access.", "threat_severity": "Moderate"}

{}