Ironic Python Agent EUVD-2026-48475

The bootc deploy_interface must be enabled on Ironic conductors and accessible to the attacking tenant. Operator-side OCI registry credentials must be in use - specifically driver_info.image_pull_secret, [deploy] image_server_user/password service config, or [oci] authentication_config conductor-wide registry auth. Exploitation of operator credentials occurs when the target node does NOT have instance_info.image_pull_secret set, causing Ironic's get_image_service_auth_override() to silently fall back to and forward operator-owned credentials as oci_pull_secret to the tenant image. Exploitation is limited to authenticated Ironic tenants with permission to deploy via the bootc interface; unauthenticated network access is insufficient. Reading back a tenant's own instance_info.image_pull_secret is explicitly classified as self-disclosure and is out of scope for this vulnerability.

Real-world risk is meaningful for any OpenStack Ironic deployment that both exposes the bootc deploy_interface to tenants and relies on operator-side OCI registry credentials (driver_info.image_pull_secret, [deploy] image_server_user/password, or [oci] authentication_config). Critically, the operator credential is exposed silently due to the auth fallback mechanism - a tenant need not know the credential exists, only that they can omit their own. No CVSS vector was provided in the source data; the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N reflects network-accessible exploitation with low tenant privileges crossing into operator credential space. No EPSS data is available. The vulnerability is not in CISA KEV and no public exploit code has been released, but the underlying technique (PID namespace traversal via /proc/1/root) is well-understood in the container security community, lowering effective complexity for a motivated attacker who already has Ironic tenant access. The primary limiting factors are the specialized deployment context (bootc interface must be enabled) and the requirement for low-privilege Ironic authentication - this is not a zero-interaction attack against default configurations.

A tenant with Ironic access submits a bare metal deployment using a malicious bootc OCI image they control. IPA writes the operator-level OCI pull secret to /root/.config/containers/auth.json on the provisioning host, then launches the tenant image with --pid=host and --privileged. Code embedded in the malicious image reads /proc/1/root/root/.config/containers/auth.json through the shared PID namespace, exfiltrates the credential to an attacker-controlled endpoint, and uses it to authenticate to the operator's private OCI registry - potentially pulling proprietary images or pivoting to other services protected by the same credential.