As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-033.html


Date: August 05, 2026
CVE: CVE-2026-71201
Affects: Ironic: >=34.0.0 <35.0.2, >=36.0.0 <38.0.1

Description:

Chen YuXiang of Institute of Computing Technology, Chinese Academy of
Sciences reported an issue in Ironic’s API. When a project reader
requests a list of portgroups filtered by shard, all portgroups in that
shard are returned, not just those in their project.

This is a similar vulnerability to the one originally advisoried in
OSSA-2026-026 – that issue impacted ports; this impacts portgroups.

Patches:
https://review.opendev.org/999762 (2026.1/gazpacho)
https://review.opendev.org/999656 (2026.2/hibiscus (development))
https://review.opendev.org/999765 (Bugfix/34.0)
https://review.opendev.org/999764 (Bugfix/37.0)
https://review.opendev.org/999763 (Bugfix/38.0)

Credits
    Chen YuXiang from Institute of Computing Technology, Chinese
    Academy of Sciences

References:
https://launchpad.net/bugs/2162715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71201

Notes:
    Ironic bugfix branch patches will be available in git for interested
    operators. We will not perform an additional release from these
    branches.

Hello,

Bug #1143790 in ironic reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/ironic/-/commit/925fc994f41133fa9a16ac112074ba65440ec87b
------------------------------------------------------------------------
* CVE-2026-71201 / OSSA-2026-033: Portgroup shard filter bypasses project
    scope. Applied upstream patch: "Portgroup shard filter bypasses scope to
    project" (Closes: #1143790).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1143790

We believe that the bug you reported is fixed in the latest version of
ironic, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143790@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated ironic package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 06 Aug 2026 11:30:51 +0200
Source: ironic
Architecture: source
Version: 1:35.0.1-9
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1143790
Changes:
 ironic (1:35.0.1-9) unstable; urgency=medium
 .
   * CVE-2026-71201 / OSSA-2026-033: Portgroup shard filter bypasses project
     scope. Applied upstream patch: "Portgroup shard filter bypasses scope to
     project" (Closes: #1143790).
Checksums-Sha1:
 ad539a1feaee71166f7c5b35303243eddd2b0e2a 4063 ironic_35.0.1-9.dsc
 616d4159d35eb9dd399235d451083c0df9471c6a 61800 ironic_35.0.1-9.debian.tar.xz
 9449ee26da03370a94ea2238491fbcad550cf9e2 22523 ironic_35.0.1-9_amd64.buildinfo
Checksums-Sha256:
 9432eb28628e9d1636a9681d2abea7b04712bc2c9a26d3c1f79974b243e25def 4063 ironic_35.0.1-9.dsc
 f0067af7cb777ca68d350f2bf025e0636493e8084ab9dcec5fc39d83ac45fe97 61800 ironic_35.0.1-9.debian.tar.xz
 ea12457fbd31ddfe82765c803478e5b12ada8f4834f8888b37b6705d584d0f8b 22523 ironic_35.0.1-9_amd64.buildinfo
Files:
 2a4f7a91ec0f7d36390b99348470c06d 4063 net optional ironic_35.0.1-9.dsc
 09a7c52b2570bca906135c3da4aeda76 61800 net optional ironic_35.0.1-9.debian.tar.xz
 ae9c838985109f05e89155ab85fa89db 22523 net optional ironic_35.0.1-9_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp0WUQACgkQ1BatFaxr
Q/6E7Q/7BAOuyskwMit4LdEmt3Ygh+atmjoCwf7cezQ1BcBJ4oq2sySr3jt/uhX4
aUdfB1zD64fhr9qdk4d8xBBfZmGtDJNzP+vQe0zzqEngHGDoIAaWaL2POGSffQC0
jNzCKPSpsxhK70Ospf4o1UuG8BYKraIkSJDLmvotkCldXaPodFLez4DxWTudJyBd
wmjlceOusp29FMoYzwRFWQy4j2zaIpTwuuCTsdypl8YNJegU83VPLUc+OjNBhmon
jYv877nvKlh7KGNUHjMoG+jzDjX3nk8KR1PXcJGIBc9JInrg7lXoxh/4kzmn5Ada
350/jm49QH+Uo/A3S40V5WxA8xwCiu6A5GyJbnZ8Vqf/M5vTs09itQs0ergbZr7p
eODIXVBueGLNdVGgubpnheaL3XsYBbCVPP9WNx+6KjcZ/FG1/ClGW5WRMRGOpsuu
D7aSDmr4Xevfjb6ibreWuSKUQex90DSv6RfGGZdcr0GA3jmrIXJtuJwq0ychuh94
/csOd/ksy3TsL6Z9ZtPHGMvuZ6Ws/Hj4oqEN7oYhkM+QS/K0+I62TOVuUJs4WOAU
izgrI6uUJcIdIsSHBeRpfu9zLfKk7FWBkl15aYVY9PMLaCRxj9MJ5CW2kqmjLcyr
wRuNEGub5XlXGpalqlIQaDPNr8sw3/G1GU8wBQ2ZOT1DulxEltA=
=Djsm
-----END PGP SIGNATURE-----