CVE-2026-43003
EUVD-2026-2648901.05.2026, 09:16
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openstack | ironic_python_agent | 1.0.0 ≤ 𝑥 ≤ 11.5.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 1787545085 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1787735456 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1786942282 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 1785883346 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-829 - Inclusion of Functionality from Untrusted Control SphereThe software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
References