Skip to content

[release-4.21] OCPBUGS-97991: CVE-2026-44918: Prevent rehoming resources to nodes with different owner - #454

Open
rh-soboh wants to merge 1 commit into
openshift:release-4.21from
rh-soboh:CVE-2026-44918-4.21
Open

[release-4.21] OCPBUGS-97991: CVE-2026-44918: Prevent rehoming resources to nodes with different owner#454
rh-soboh wants to merge 1 commit into
openshift:release-4.21from
rh-soboh:CVE-2026-44918-4.21

Conversation

@rh-soboh

@rh-soboh rh-soboh commented Jul 29, 2026

Copy link
Copy Markdown

Summary

Cherry-pick upstream fix for CVE-2026-44918 / OSSA-2026-026 into release-4.21.
Prevents rehoming volume connectors/targets (and related parent/child and port resources) onto nodes with a different owner without re-checking access on the destination node.

Upstream

Jira

OCPBUGS-97991

@dtantsur @rh-soboh
CVE-2026-44918: Prevent rehoming resources to nodes with different owner
52055c2 
Ironic has a few similar patterns where only the source node is verified
during a create or update operation:
1. A node can be created with a parent from a different project
2. Node can be updated to have a parent from a different project
3. Ports, port groups, volume targets and volume connectors can be
   patched to be owned by a node from a different project.

This patch addresses all these cases and introduces a single helper to
cover all of them.

Also makes sure that baremetal:node:get is checked even if the parent
node ID is a UUID (it was missing before).

Related-Bug: 2150450
Change-Id: Iaa512f380926a9fc032eefea5bcdcbc5040a4739
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
Signed-off-by: Jay Faulkner <jay@jvf.cc>
(cherry picked from commit b58d4ad)
@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 29, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 29, 2026

Copy link
Copy Markdown

@rh-soboh: This pull request references Jira Issue OCPBUGS-97991, which is invalid:

  • expected Jira Issue OCPBUGS-97991 to depend on a bug targeting a version in 4.22.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Cherry-pick upstream fix for CVE-2026-44918 / OSSA-2026-026 into release-4.21.
Prevents rehoming volume connectors/targets (and related parent/child and port resources) onto nodes with a different owner without re-checking access on the destination node.

Upstream

Jira

OCPBUGS-97991

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@rh-soboh

rh-soboh commented Jul 29, 2026

Copy link
Copy Markdown
Author

/ok-to-test

@openshift-ci openshift-ci Bot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Jul 29, 2026
@openshift-ci
openshift-ci Bot requested review from derekhiggins and dtantsur July 29, 2026 12:58
@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown

@rh-soboh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@iurygregory

iurygregory commented Jul 29, 2026

Copy link
Copy Markdown

/approve

@openshift-ci

openshift-ci Bot commented Jul 29, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: iurygregory, rh-soboh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 29, 2026
@elfosardo

elfosardo commented Jul 31, 2026

Copy link
Copy Markdown

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@derekhiggins derekhiggins Awaiting requested review from derekhiggins
@dtantsur dtantsur Awaiting requested review from dtantsur

Assignees

@elfosardo elfosardo

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@rh-soboh @openshift-ci-robot @iurygregory @elfosardo @dtantsur