CVE-2026-43003

HighCVSS 8.0

Published: 01/05/2026(UTC)Updated: 09/09/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.98%

60th percentile - higher than 60% of all known CVEs

Summary

A vulnerability in OpenStack ironic-python-agent versions 1.0.0 through 11.5.0 allows code execution via a malicious partition image. IPA sometimes runs grub-install inside a chroot of the deployed image, leading to code execution.

Risk Assessment

The organization is at risk of having deployed system images compromised, potentially leading to data integrity and confidentiality breaches.

Recommendation

Immediately upgrade ironic-python-agent to version 11.5.1 or later and verify the integrity of all partition images in use.

Other vulnerabilities in ironic-python-agent

CVE-2026-54422Medium
In OpenStack Ironic Python Agent through version 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

Original NVD description (English source)

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.