What is the CVSS score of CVE-2026-54422?

CVE-2026-54422 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ironic Python Agent are affected by CVE-2026-54422?

OpenStack Ironic Python Agent versions 10.2.0-10.2.2, 11.0.0-11.2.0, and 11.3.0-11.5.0 contain a critical credential extraction vulnerability affecting deployments with bootc deploy_interface…. A patch is available.

How to fix or mitigate CVE-2026-54422?

Within 24 hours, identify all OpenStack deployments running vulnerable IPA versions (10.2.0-10.2.2, 11.0.0-11.2.0, 11.3.0-11.5.0) with bootc deploy_interface enabled and immediately audit which operator-level OCI registry credentials are accessible from those systems. Within 7 days, disable bootc deploy_interface if not operationally critical, and rotate all OCI registry pull secrets with documented timestamp; restrict tenant deploy_interface choices to non-bootc alternatives. Within 30 days, monitor Ironic upstream releases for a CVE-2026-54422 patch; upon availability, test the patch in a staging environment and deploy to production.

Ironic Python Agent CVE-2026-54422

EUVD-2026-48475 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-07-23

GHSA-7r4g-5584-3hjx

Python Information Disclosure

5.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.5 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Tenant deploys via network API with low Ironic privileges (AV:N, AC:L, PR:L); container reads cross-boundary operator secret (S:C, C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 24, 2026 - 06:02 EUVD

CVSS changed

Jul 24, 2026 - 05:22 NVD

5.5 (MEDIUM)

Analysis Generated

Jul 23, 2026 - 22:22 vuln.today

CVE Published

Jul 23, 2026 - 19:25 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 3 New Python Vulnerabilities - 1 Critical, 2 High Severity Jul 24, 2026 News Critical Credential Theft via PID Namespace Escape in OpenStack Ironic Python Agent - CVE-2026-54422 Jul 23, 2026

AnalysisAI

Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.

Technical ContextAI

Ironic Python Agent implements the bootc deploy_interface to provision bare metal nodes by running OCI container images via podman. During deployment, IPA writes OCI registry authentication material (the pull secret) to /root/.config/containers/auth.json on the host, then launches the tenant-supplied bootc image using 'podman run --privileged --pid=host --authfile=/root/.config/containers/auth.json'. The --pid=host flag shares the host PID namespace with the container, enabling code inside the container to traverse the host filesystem via /proc/1/root - a well-documented Linux namespace escape path. Code inside a malicious bootc image can therefore read /proc/1/root/root/.config/containers/auth.json and recover whatever credential was forwarded by IPA. The root cause aligns with CWE-522 (Insufficiently Protected Credentials): credentials are stored in a location accessible to untrusted tenant code through a privileged container execution context. Ironic's credential fallback logic (get_image_service_auth_override() prefers instance_info, then driver_info, then [deploy] basic auth) means operator-level secrets are silently forwarded to tenant images when the tenant omits their own pull secret. Researcher Yuliang Xiao confirmed the attack experimentally with a disposable VM; a non-privileged container could not access the credential, confirming that --pid=host combined with --privileged is the enabling condition.

RemediationAI

The primary fix is to apply upstream patches published via OpenDev review: https://review.opendev.org/998479 (2026.2/hibiscus), https://review.opendev.org/998481 (2026.1/gazpacho), https://review.opendev.org/998484 (2025.2/flamingo), https://review.opendev.org/998485 (2025.1/epoxy), https://review.opendev.org/998480 (bugfix/11.6), https://review.opendev.org/998493 (bugfix/11.4), and https://review.opendev.org/998494 (bugfix/11.3). Upstream fix available as commits and review patches; no additional tagged release will be made from the bugfix branches, so operators on those branches must apply commits directly rather than waiting for a package version bump. As an immediate compensating control, operators can completely disable the bootc deploy_interface on all Ironic conductors - this eliminates the attack surface entirely but prevents all bootc-based bare metal provisioning. Operators should also audit whether operator-side credentials are currently configured alongside tenant-accessible bootc deployments, and consider requiring tenants to supply instance_info.image_pull_secret explicitly to prevent silent credential fallback.