CVE-2026-43003
OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
CVE-2026-43003- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829, CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-26489
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
EUVD-2026-26489- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rmxr-45gj-889w
OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
GHSA-rmxr-45gj-889w- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78, CWE-829
- Updated
- 2026-11-02
NVD
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
CVE-2026-43003- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829, CWE-78
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
CVE-2026-43003- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-43003
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
DEBIAN-CVE-2026-43003- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rmxr-45gj-889w
OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
GHSA-rmxr-45gj-889w- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78, CWE-829
- Updated
- 2026-11-02
OSVPYSEC-2026-205
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
PYSEC-2026-205- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-43003
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
- Record
UBUNTU-CVE-2026-43003- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ironic-python-agentPyPI |
1.0.0 to 11.5.0 | 11.6.0 |
ironicDebian:12 |
before 1:21.4.4-0+deb12u2, plus listed versions 1:21.1.0-31:21.1.0-3+deb12u11:21.3.0-11:21.4.0-11:21.4.0-21:21.4.0-31:21.4.0-41:21.4.4-0+deb12u1 |
1:21.4.4-0+deb12u2 |
ironicDebian:13 |
before 1:29.0.5-0+deb13u3, plus listed versions 1:29.0.0-71:29.0.5-0+deb13u11:29.0.5-0+deb13u2 |
1:29.0.5-0+deb13u3 |
ironicDebian:14 |
before 1:35.0.1-7, plus listed versions 1:29.0.0-71:32.0.0-11:32.0.0-21:32.0.0-41:32.0.0-5 Show 10 moreShow less1:32.0.0-61:32.0.0-71:34.0.0-11:35.0.0-11:35.0.0-21:35.0.1-11:35.0.1-21:35.0.1-31:35.0.1-51:35.0.1-6 |
1:35.0.1-7 |
ironic-python-agentDebian:13 |
All versions, plus listed versions 10.2.0-311.1.0-111.2.0-111.2.0-211.4.0-1 Show 9 moreShow less11.5.0-111.5.0-211.5.0-311.5.0-411.5.0-512.0.0-112.0.0-213.0.0-113.0.0-2 |
None known |
ironic-python-agentDebian:14 |
before 11.5.0-3, plus listed versions 10.2.0-311.1.0-111.2.0-111.2.0-211.4.0-111.5.0-111.5.0-2 |
11.5.0-3 |
ironic-python-agentPyPI |
1.0.0 up to 11.6.0, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 Show 45 moreShow less1.1.01.2.01.2.11.2.21.2.31.3.01.4.01.5.01.5.11.5.210.0.010.1.010.2.010.2.110.2.210.2.311.0.011.1.011.2.011.3.011.4.011.5.02.0.02.0.12.0.22.0.32.1.02.2.02.2.12.2.22.2.32.2.43.0.03.1.03.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.4.03.5.0 |
11.6.0 |
ironic-python-agentPyPI |
1.0.0 up to 11.6.0, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 Show 45 moreShow less1.1.01.2.01.2.11.2.21.2.31.3.01.4.01.5.01.5.11.5.210.0.010.1.010.2.010.2.110.2.211.0.011.1.011.2.011.3.011.4.011.5.02.0.02.0.12.0.22.0.32.1.02.2.02.2.12.2.22.2.32.2.43.0.03.1.03.2.03.2.13.2.23.2.33.2.43.3.03.3.13.3.23.3.33.4.03.5.03.6.0 |
11.6.0 |
ironic-python-agentUbuntu:24.04:LTS |
All versions, plus listed versions 9.1.0-1ubuntu1 |
None known |
ironic-python-agentUbuntu:25.10 |
All versions, plus listed versions 9.14.0-510.2.0-3 |
None known |
ironic-python-agentUbuntu:26.10 |
All versions, plus listed versions 11.2.0-211.5.0-211.5.0-311.5.0-411.5.0-5 |
None known |
ironic-python-agentUbuntu:26.04:LTS |
All versions, plus listed versions 10.2.0-311.2.0-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-43003 is a high vulnerability (CVSS 8.0) in Openstack Ironic-python-agent, published May 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in ironic-python-agent 11.6.0.
References
bugs.launchpad.net/ironic-python-agent/+bug/2148310
github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py
openwall.com/lists/oss-security/2026/06/16/11
access.redhat.com/security/cve/CVE-2026-43003
bugzilla.redhat.com/show_bug.cgi?id=2464306
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-43003
opendev.org/openstack/ironic-python-agent/commit/6cd463a657edcddf7b79416ac69bdef5b6f30099
security-tracker.debian.org/tracker/CVE-2026-43003
ubuntu.com/security/CVE-2026-43003
cve.org/CVERecord?id=CVE-2026-43003
Left out here: 139 versions. The JSON record has them.