[release-4.21] OCPBUGS-97991: CVE-2026-44918: Prevent rehoming resources to nodes with different owner - #454
Conversation
Ironic has a few similar patterns where only the source node is verified during a create or update operation: 1. A node can be created with a parent from a different project 2. Node can be updated to have a parent from a different project 3. Ports, port groups, volume targets and volume connectors can be patched to be owned by a node from a different project. This patch addresses all these cases and introduces a single helper to cover all of them. Also makes sure that baremetal:node:get is checked even if the parent node ID is a UUID (it was missing before). Related-Bug: 2150450 Change-Id: Iaa512f380926a9fc032eefea5bcdcbc5040a4739 Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com> Signed-off-by: Jay Faulkner <jay@jvf.cc> (cherry picked from commit b58d4ad)
openshift-ci-robot
added
jira/severity-important
|
@rh-soboh: This pull request references Jira Issue OCPBUGS-97991, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/ok-to-test |
openshift-ci
Bot
added
the
ok-to-test
|
@rh-soboh: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: iurygregory, rh-soboh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/lgtm |
|
/jira refresh |
|
@rh-soboh: This pull request references Jira Issue OCPBUGS-97991, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
the
jira/valid-bug
|
@rh-soboh: This pull request references Jira Issue OCPBUGS-97991, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
jira/invalid-bug
6acc6b8
into
openshift:release-4.21
|
@rh-soboh: Jira Issue OCPBUGS-97991: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-97991 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
5 participants
Summary
Cherry-pick upstream fix for CVE-2026-44918 / OSSA-2026-026 into release-4.21.
Prevents rehoming volume connectors/targets (and related parent/child and port resources) onto nodes with a different owner without re-checking access on the destination node.
Upstream
Jira
OCPBUGS-97991