What is the CVSS score of CVE-2026-66138?

CVE-2026-66138 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ironic Python Agent are affected by CVE-2026-66138?

OpenStack Ironic deployments using version 11.6.0 or earlier are vulnerable to infrastructure compromise through a command injection flaw exploitable by users with manager role permissions; no known…

How to fix or mitigate CVE-2026-66138?

Within 24 hours, audit your environment to determine whether OpenStack Ironic is deployed, identify all running instances (versions through 11.6.0), and document manager role assignments. Immediately restrict manager role access to only essential personnel and enable multi-factor authentication for all accounts with provisioning privileges. Within 7 days, implement network segmentation to isolate Ironic provisioning networks, enable detailed audit logging for all IPA activities, and deploy monitoring to flag anomalous ntp_server parameter values in provisioning requests. Over the next 30 days, monitor OpenStack security advisories for an available patch and plan an immediate upgrade upon release; maintain strict access controls and continuous monitoring as primary controls until patched.

Ironic Python Agent CVE-2026-66138

EUVD-2026-48476 HIGH

OS Command Injection (CWE-78)

2026-07-24 mitre

GHSA-wj9f-vqw7-855c

Command Injection RCE Python Ironic Python Agent Red Hat

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Config is set over the API so AV:N/AC:L, but the manager role is a privileged non-default grant so PR:H; shell injection yields full C:H/I:H/A:H on the agent.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:16 vuln.today

CVE Published

Jul 24, 2026 - 03:53 cve.org

HIGH 7.2

DescriptionCVE.org

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

AnalysisAI

Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Ironic is OpenStack's bare-metal provisioning service; the Ironic Python Agent is the ramdisk-resident agent that runs on nodes during deployment, cleaning, and inspection and applies configuration handed to it by the Ironic conductor. This flaw is a classic CWE-78 OS Command Injection: the ntp_server configuration value is concatenated into a command that is executed via a shell rather than being passed as an argument vector or validated, so shell metacharacters embedded in ntp_server break out into arbitrary command execution. The affected component is identified by CPE cpe:2.3:a:openstack:ironic_python_agent covering all versions up to and including 11.6.0.

RemediationAI

Upgrade Ironic Python Agent to a fixed release as directed by OpenStack advisory OSSA-2026-027 (https://security.openstack.org/ossa/OSSA-2026-027.html) and the Launchpad bug (https://bugs.launchpad.net/ironic-python-agent/+bug/2160050); no exact fixed version number was provided in the input, so confirm the patched build from that advisory before deploying - patch available per vendor advisory. As a compensating control until patched, restrict which principals may hold the project-scoped manager role and tighten Ironic RBAC so untrusted tenants cannot set node driver_info/configuration fields such as ntp_server, and validate or reject shell metacharacters in ntp_server at the API/policy layer; the trade-off is reduced self-service configuration for tenants and added operational overhead in managing role assignments. Avoid exposing the Ironic API to untrusted networks and monitor for anomalous configuration changes to node NTP settings.