EUVD-2026-26489
GHSA-rmxr-45gj-889w
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Code executes locally during deploy of an attacker-supplied image, so AV:L; crafting and getting the image deployed needs deploy privileges and effort (PR:L, AC:H), yielding full root impact on the node (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionNVD
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
AnalysisAI
Arbitrary code execution in OpenStack ironic-python-agent (IPA) versions 1.0.0 through 11.5.0 occurs because IPA runs grub-install from inside a chroot of the partition image it is deploying, so binaries supplied by a malicious image execute on the provisioning ramdisk. An attacker able to have a crafted partition image deployed can run code in the IPA context (typically root on the bare-metal node being provisioned). No public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records exploitation status as none, but the technical impact is rated total.
Technical ContextAI
Ironic Python Agent is the ramdisk-side component of OpenStack Ironic, the bare-metal provisioning service. During UEFI-based deployments IPA writes a partition image to local disk and, to make the node bootable, chroots into the freshly written filesystem and invokes grub-install (see efi_utils.py around lines 134-139). Because grub-install and the binaries/libraries it resolves come from the deployed image's filesystem rather than a trusted environment, a hostile image can ship a trojaned grub-install or supporting executable. This is a classic CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere) condition: trusted, privileged code (the deploy ramdisk, running as root) executes untrusted code drawn from the attacker-controlled image. The affected component is identified by cpe:2.3:a:openstack:ironic-python-agent:*:*:*:*:*:*:*:*.
RemediationAI
A fix is available from the vendor (Patch: Available from vendor), so upgrade ironic-python-agent beyond the affected 11.5.0 branch to the patched release indicated in the upstream Launchpad bug (bugs.launchpad.net/ironic-python-agent/+bug/2148310) and the oss-security advisory (seclists.org/oss-sec/2026/q2/949); the exact patched version is not stated in the provided data, so confirm it from the upstream release notes or your distribution. Red Hat consumers should track and apply errata via access.redhat.com/security/cve/CVE-2026-43003 and its CSAF VEX. Until patched, the most effective compensating control is to ensure only trusted, signed, and integrity-verified images are deployable - restrict who can register/select deployment images and enable image signature verification, accepting the operational overhead of a signing workflow. Where feasible, avoid the partition-image plus chroot grub-install path (e.g., prefer whole-disk images that do not require the chroot grub-install step), noting this may change your boot-configuration process; and limit Ironic deploy/image-management privileges to trusted operators to reduce who can introduce a hostile image.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today