CVE-2026-54422

MediumCVSS 5.5

Published: 24/07/2026(UTC)Updated: 09/09/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

In OpenStack Ironic Python Agent through version 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

Risk Assessment

An attacker can obtain credentials, potentially leading to unauthorized access to OpenStack resources.

Recommendation

Update ironic-python-agent to version 11.5.0 or later and use secure credential storage methods.

Other vulnerabilities in Ironic Python Agent

CVE-2026-43003High
A vulnerability in OpenStack ironic-python-agent versions 1.0.0 through 11.5.0 allows code execution via a malicious partition image. IPA sometimes runs grub-install inside a chroot of the deployed image, leading to code execution.

Original NVD description (English source)

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.