when new host is created by GUI it ignores selected security group
example from log:

Adding Compute instance for mdu-ddt569.int.na.XXXXX.com
Cache read: use_shortname_for_vms
  Setting Load (1.1ms)  SELECT "settings".* FROM "settings" WHERE "settings"."name" = 'use_shortname_for_vms' ORDER BY name LIMIT 1
Cache write: use_shortname_for_vms
  KeyPair Load (0.5ms)  SELECT "key_pairs".* FROM "key_pairs" WHERE "key_pairs"."compute_resource_id" = 1 LIMIT 1
creating VM with the following options: {"name"=>"mdu-ddt569.int.na.XXXXX.com", "key_name"=>"foreman-18e75c84a-eb5f-4977-84e3-2dfa8b0bb239", "availability_zone"=>"na.dev", "block_device_mapping"=>[{"device_name"=>"/dev/vda", "volume_size"=>20, "volume_id"=>""}], "flavor_ref"=>"49", "tenant_id"=>"103a49bb861e485ea05aa78f9b0216bd", "security_group"=>"dev-single", "image_ref"=>"4d189653-932d-4fb6-91ca-ec84c3578fb4"}

looking at instance details:

nova list-secgroup 3290efda-d8bd-448e-9765-65e34cf332b2
+----+---------+-------------+
| Id | Name    | Description |
+----+---------+-------------+
| 21 | default | default     |
+----+---------+-------------+

but when host is created by API call (curl) it works as expected.
log file:

creating VM with the following options: {"name"=>"mdu-ddt569-2.int.na.XXXXX.com", "key_name"=>"foreman-18e75c84a-eb5f-4977-84e3-2dfa8b0bb239", "availability_zone"=>"na.dev", "block_device_mapping"=>[{"device_name"=>"/dev/vda", "volume_size"=>20, "volume_id"=>""}], "flavor_ref"=>"49", "image_ref"=>"4d189653-932d-4fb6-91ca-ec84c3578fb4", "security_groups"=>["dev-single"], "tenant_id"=>"103a49bb861e485ea05aa78f9b0216bd"}

the problem is with the security group parameter:
' "security_groups"=>["dev-single"]' vs '"security_group"=>"dev-single"'