CVE-2026-54422

EUVD-2026-48475
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
5.5 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openstackironic_python_agent
10.2.0 ≤
𝑥
< 10.2.3
CNA
openstackironic_python_agent
11.0.0 ≤
𝑥
< 11.2.1
CNA
openstackironic_python_agent
11.3.0 ≤
𝑥
< 11.5.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
ironic-python-agent
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://bugs.launchpad.net/ironic-python-agent/+bug/2155826
https://security.openstack.org/ossa/OSSA-2026-028.html
https://www.openwall.com/lists/oss-security/2026/07/23/4
http://www.openwall.com/lists/oss-security/2026/07/23/4