PT-2026-36307 · Openstack · Ironic-Python-Agent

Dmitry Tantsur

+1

·

CVE-2026-43003

·

Published

2026-05-01

·

Updated

2026-06-18

CVSS v3.1

8.5

High

VectorAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenStack ironic-python-agent versions 1.0.0 through 11.5.0
Description Ironic Python Agent (IPA) may execute the grub-install function from within a chroot of the deployed partition image. This behavior can lead to arbitrary code execution if a malicious image is used.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-829CWE-78

Related Identifiers

CVE-2026-43003
GHSA-RMXR-45GJ-889W
PYSEC-2026-205

Affected Products

Ironic-Python-Agent