[release-4.13] OCPBUGS-97987: CVE-2026-44918: Prevent rehoming resources to nodes with different owner - #463
Conversation
Ironic has a few similar patterns where only the source node is verified during a create or update operation: This is a focused backport to address object re-homing outside the scope of parent/child node modeling. i.e., only item 3 from the original commit to fix the CVE, because items 1 and 2 from that fix did not apply to this branch. 3. Ports, port groups, volume targets and volume connectors can be patched to be owned by a node from a different project. Related-Bug: 2150450 Change-Id: Iaa512f380926a9fc032eefea5bcdcbc5040a4739 Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com> Signed-off-by: Jay Faulkner <jay@jvf.cc> (cherry picked from commit b58d4ad) (cherry picked from commit d99b35d) (cherry picked from commit 54e4cf7) (cherry picked from commit 72d759a)
openshift-ci-robot
added
jira/severity-important
|
@rh-soboh: This pull request references Jira Issue OCPBUGS-97987, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/ok-to-test |
openshift-ci
Bot
added
the
ok-to-test
|
/retest |
Portgroup has no real node_uuid object field (only node_id), unlike Port/VolumeConnector/VolumeTarget which do. The CVE-2026-44918 backport removed the pre-assignment of node_uuid before applying the patch, which is safe for those other resources but breaks Portgroup PATCH: the jsonpatch validator rejects it as adding a new top-level attribute. Restore the pre-assignment using the already-authorized node (authorize_node_link_patch still runs before apply_jsonpatch, so the owner check is preserved).
|
@rh-soboh: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: elfosardo, rh-soboh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
4 participants
Summary
Cherry-pick upstream fix for CVE-2026-44918 / OSSA-2026-026 into release-4.13.
Prevents rehoming ports, port groups, volume connectors, and volume targets onto nodes with a different owner without re-checking access on the destination node.
Also raises flake8 max-complexity 19 → 21 to match upstream lint headroom for the new helper.
Upstream
Jira
OCPBUGS-97987