OS command injection in OpenStack ironic-python-agent
Priority LOW 39CWE-829Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-829.
Summary
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00983 62nd percentileScored 2026-11-07
Fix Partial ironic-python-agent (OpenStack): 10.2.3, 11.2.1, 11.5.1ironic-python-agent (PyPI): 11.6.0Red Hat: 7 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenStack | ironic-python-agent | before 10.2.3; 11.0.0 to before 11.2.1; 11.3.0 to before 11.5.1 | 10.2.3, 11.2.1, 11.5.1 | Patch available | CNA |
| — | ironic-python-agent (PyPI) | 1.0.0 to before 11.6.0 | 11.6.0 | Patch available | GHSA-rmxr-45gj-889w |
- ironic-python-agent VendorOpenStack Affected before 10.2.3; 11.0.0 to before 11.2.1; 11.3.0 to before 11.5.1 Fixed in 10.2.3, 11.2.1, 11.5.1 Patch available CNA
- ironic-python-agent (PyPI) Vendor— Affected 1.0.0 to before 11.6.0 Fixed in 11.6.0 Patch available GHSA-rmxr-45gj-889w
Remediation
- Fix · CNA ironic-python-agent (OpenStack) Fixed in 10.2.3, 11.2.1, 11.5.1
- Fix · GHSA-rmxr-45gj-889w ironic-python-agent (PyPI) Fixed in 11.6.0 Advisory →
Red Hat 7 advisories
- RHSA-2026:70587 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.58 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:67936 Released 2026-09-24 · Red Hat rating ImportantOpenShift Container Platform 4.16.71 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:65852 Released 2026-09-17 · Red Hat rating ImportantOpenShift Container Platform 4.18.55 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +19
Show 4 more Red Hat advisories
- RHSA-2026:60454 Released 2026-09-02 · Red Hat rating ImportantOpenShift Container Platform 4.19.45 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-cli-artifacts-rhel9, registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator +12
- RHSA-2026:60446 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.20.36 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +18
- RHSA-2026:57801 Released 2026-08-25 · Red Hat rating ImportantOpenShift Container Platform 4.21.30 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
- RHSA-2026:51038 Released 2026-08-11 · Red Hat rating ImportantOpenShift Container Platform 4.22.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:67936 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:70587 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:65852 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:60454 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:60446 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:57801 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:51038 |
Not affected: 7 products
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-43003
- 2026-10-03 Alias added: GHSA-rmxr-45gj-889w
References
Other 13
- https://bugs.launchpad.net/ironic-python-agent/+bug/2148310
- https://github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py#L134-L139
- https://access.redhat.com/errata/RHSA-2026:51038
- https://access.redhat.com/errata/RHSA-2026:57801
- https://access.redhat.com/errata/RHSA-2026:60446
- https://access.redhat.com/errata/RHSA-2026:60454
- https://access.redhat.com/security/cve/CVE-2026-43003
- https://bugzilla.redhat.com/show_bug.cgi?id=2464306
- https://github.com/openstack/ironic-python-agent
- https://github.com/pypa/advisory-database/tree/main/vulns/ironic-python-agent/PYSEC-2026-205.yaml
- https://opendev.org/openstack/ironic-python-agent/commit/6cd463a657edcddf7b79416ac69bdef5b6f30099
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json
- http://www.openwall.com/lists/oss-security/2026/06/16/11
Sources
- CVE-2026-43003 · CVE Program
- CVE-2026-43003 · NVD
- FIRST EPSS
- GHSA-rmxr-45gj-889w · GitHub Advisory Database · CC BY 4.0
- CVE-2026-43003 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences