{"id":"CVE-2026-43003","aliases":["DEBIAN-CVE-2026-43003","EUVD-2026-26489","GHSA-rmxr-45gj-889w","PYSEC-2026-205","UBUNTU-CVE-2026-43003"],"status":"published","title":"OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00983,"percentile":0.62594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-829"],"published":"2026-05-01T00:00:00Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"PyPI","package":"ironic-python-agent","fixed_in":["11.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ironic","fixed_in":["1:21.4.4-0+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ironic","fixed_in":["1:29.0.5-0+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ironic","fixed_in":["1:35.0.1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ironic-python-agent","fixed_in":["11.5.0-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"11.5.0"},{"fixed":"11.6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:21.4.4-0+deb12u2"}]}],"versions":["1:21.1.0-3","1:21.1.0-3+deb12u1","1:21.3.0-1","1:21.4.0-1","1:21.4.0-2","1:21.4.0-3","1:21.4.0-4","1:21.4.4-0+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.0.5-0+deb13u3"}]}],"versions":["1:29.0.0-7","1:29.0.5-0+deb13u1","1:29.0.5-0+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:35.0.1-7"}]}],"versions":["1:29.0.0-7","1:32.0.0-1","1:32.0.0-2","1:32.0.0-4","1:32.0.0-5","1:32.0.0-6","1:32.0.0-7","1:34.0.0-1","1:35.0.0-1","1:35.0.0-2","1:35.0.1-1","1:35.0.1-2","1:35.0.1-3","1:35.0.1-5","1:35.0.1-6"]},{"source":"osv","ecosystem":"Debian:13","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.0-3","11.1.0-1","11.2.0-1","11.2.0-2","11.4.0-1","11.5.0-1","11.5.0-2","11.5.0-3","11.5.0-4","11.5.0-5","12.0.0-1","12.0.0-2","13.0.0-1","13.0.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.0-3"}]}],"versions":["10.2.0-3","11.1.0-1","11.2.0-1","11.2.0-2","11.4.0-1","11.5.0-1","11.5.0-2"]},{"source":"osv","ecosystem":"PyPI","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"11.6.0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.4.0","1.5.0","1.5.1","1.5.2","10.0.0","10.1.0","10.2.0","10.2.1","10.2.2","10.2.3","11.0.0","11.1.0","11.2.0","11.3.0","11.4.0","11.5.0","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","3.0.0","3.1.0","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.5.0","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.7.0","4.0.0","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","6.0.0","6.1.0","6.1.1","6.1.2","6.1.3","6.2.0","6.3.0","6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.5.0","6.6.0","7.0.0","7.0.1","7.0.2","7.1.0","8.0.0","8.1.0","8.2.0","8.2.1","8.2.2","8.2.3","8.3.0","8.4.0","8.5.0","8.5.1","8.5.2","8.5.3","8.6.0","9.0.0","9.1.0","9.1.1","9.10.0","9.11.0","9.11.1","9.11.2","9.11.3","9.12.0","9.13.0","9.14.0","9.14.1","9.2.0","9.3.0","9.4.0","9.4.1","9.4.2","9.4.3","9.5.0","9.6.0","9.7.0","9.7.1","9.7.2","9.7.3","9.8.0","9.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"11.6.0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.4.0","1.5.0","1.5.1","1.5.2","10.0.0","10.1.0","10.2.0","10.2.1","10.2.2","11.0.0","11.1.0","11.2.0","11.3.0","11.4.0","11.5.0","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","3.0.0","3.1.0","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.5.0","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.7.0","4.0.0","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","6.0.0","6.1.0","6.1.1","6.1.2","6.1.3","6.2.0","6.3.0","6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.5.0","6.6.0","7.0.0","7.0.1","7.0.2","7.1.0","8.0.0","8.1.0","8.2.0","8.2.1","8.2.2","8.2.3","8.3.0","8.4.0","8.5.0","8.5.1","8.5.2","8.5.3","8.6.0","9.0.0","9.1.0","9.1.1","9.10.0","9.11.0","9.11.1","9.11.2","9.11.3","9.12.0","9.13.0","9.14.0","9.14.1","9.2.0","9.3.0","9.4.0","9.4.1","9.4.2","9.4.3","9.5.0","9.6.0","9.7.0","9.7.1","9.7.2","9.7.3","9.8.0","9.9.0"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.14.0-5","10.2.0-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.2.0-2","11.5.0-2","11.5.0-3","11.5.0-4","11.5.0-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.0-3","11.2.0-2"]}],"products":[{"vendor":"openstack","product":"ironic-python-agent"},{"vendor":"openstack","product":"ironic_python_agent"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"}],"references":[{"url":"https://bugs.launchpad.net/ironic-python-agent/+bug/2148310","tags":["Issue Tracking","web","report"]},{"url":"https://github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py#L134-L139","tags":["Product","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/16/11","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43003","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464306","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60454","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60446","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57801","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51038","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43003","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ironic-python-agent/PYSEC-2026-205.yaml","tags":["web"]},{"url":"https://opendev.org/openstack/ironic-python-agent/commit/6cd463a657edcddf7b79416ac69bdef5b6f30099","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rmxr-45gj-889w","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43003.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43003","tags":["advisory"]},{"url":"https://github.com/openstack/ironic-python-agent","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-43003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43003","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-43003","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T00:00:00Z","modified":"2026-09-09T12:04:49.482Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-829","CWE-78"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-26489","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T00:00:00Z","modified":"2026-09-09T12:04:49Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-rmxr-45gj-889w","title":"OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T09:30:25Z","modified":"2026-09-02T15:33:47Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78","CWE-829"],"updated_at":"2026-11-02T14:41:10.121131Z"}],"nvd":[{"id":"CVE-2026-43003","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T09:16:17.44Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-829","CWE-78"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"CVE-2026-43003","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T00:00:00Z","modified":"2026-10-28T02:31:12.342898675Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-43003","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T09:16:17.44Z","modified":"2026-10-27T10:01:29.84143083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"GHSA-rmxr-45gj-889w","title":"OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T09:30:25Z","modified":"2026-09-02T15:45:19.865952682Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78","CWE-829"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"PYSEC-2026-205","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T09:16:17.44Z","modified":"2026-06-10T17:01:52.594852079Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-43003","description":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.","status":"published","published":"2026-05-01T09:16:00Z","modified":"2026-10-17T12:58:54.743282483Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}