OpenStack Ironic exposes a node management REST API. In NodesController.patch() in ironic/api/controllers/v1/node.py, a per-field policy enforcement block maps specific JSON Patch paths to the OpenStack policy rule that must be satisfied before that field can be modified. The list covered fields such as /retired (baremetal:node:update:retired), /shard, /parent_node, and /disable_power_off, but did not include /maintenance. The maintenance field was already listed in PATCH_ALLOWED_FIELDS, so PATCH /v1/nodes/{ident} with op:replace path:/maintenance value:true|false was accepted and only checked against the generic baremetal:node:update policy rule. Under Ironic project-scoped RBAC, baremetal:node:update is granted to lessee members, whereas baremetal:node:set_maintenance and baremetal:node:clear_maintenance are restricted to lessee managers and administrators. This allows a lessee member to toggle maintenance mode on nodes in their project, bypassing the intended access boundary. The dedicated maintenance API at /v1/nodes/{ident}/maintenance applies the correct set_maintenance/clear_maintenance policies. maintenance_reason was not in PATCH_ALLOWED_FIELDS before the fix (PATCH including it would be rejected with HTTP 400); only maintenance was an active exploit path via generic PATCH. Upstream fix maps /maintenance and /maintenance_reason to baremetal:node:set_maintenance (Change-Id: Ibab11b186ec0b0151e3720cd8cf9cf529ffd1112, Launchpad #2166510). Affected upstream: master and stable/2026.2 per embargo patches. Reporters: Tuomo Tanskanen (Ericsson Software Technology), Dmitry Tantsur (Red Hat). PSIRT ticket: PSIRTSUPT-25549.