CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using...
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
CVE-2026-54422- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
EUVDEUVD-2026-48475
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
EUVD-2026-48475- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7r4g-5584-3hjx
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using...
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
GHSA-7r4g-5584-3hjx- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
NVD
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
CVE-2026-54422- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSV
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
CVE-2026-54422- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
DEBIAN-CVE-2026-54422- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
- Record
UBUNTU-CVE-2026-54422- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ironic-python-agentDebian:13 |
All versions, plus listed versions 10.2.0-311.1.0-111.2.0-111.2.0-211.4.0-1 Show 9 moreShow less11.5.0-111.5.0-211.5.0-311.5.0-411.5.0-512.0.0-112.0.0-213.0.0-113.0.0-2 |
None known |
ironic-python-agentDebian:14 |
before 11.5.0-4, plus listed versions 10.2.0-311.1.0-111.2.0-111.2.0-211.4.0-111.5.0-111.5.0-211.5.0-3 |
11.5.0-4 |
ironic-python-agentUbuntu:24.04:LTS |
All versions, plus listed versions 9.1.0-1ubuntu1 |
None known |
ironic-python-agentUbuntu:26.10 |
All versions, plus listed versions 11.2.0-211.5.0-211.5.0-311.5.0-411.5.0-5 |
None known |
ironic-python-agentUbuntu:26.04:LTS |
All versions, plus listed versions 10.2.0-311.2.0-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54422 is a medium vulnerability (CVSS 5.5) in Openstack Ironic Python Agent, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. Fixed in ironic-python-agent 11.5.0-4.