CVE-2026-44918 is a missing authorization vulnerability in OpenStack Ironic before version 37.0.1. It allows users with high privileges to create or modify nodes across different projects without proper authorization checks. This flaw could lead to unauthorized changes in node configurations, impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Affected versions explicitly include 27.0.0, 30.0.0, 33.0.0, and 36.0.0. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthorized creation or modification of nodes across projects, which can compromise the confidentiality and integrity of node data within OpenStack Ironic environments. This could lead to unauthorized access or changes to infrastructure managed by Ironic, potentially affecting multi-tenant cloud environments. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to users with high privileges and monitor for unauthorized node modifications. Avoid using affected versions in production environments where cross-project isolation is critical.