{"id":"CVE-2026-43003","title":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0","summary":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a mal…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-829","CWE-78"],"vendor":"openstack","product":"ironic_python_agent","affected":["ironic_python_agent >= 1.0.0, <= 11.5.0"],"patched":["openshift_container_platform 4.19","openshift_container_platform 4.21","openshift_container_platform 4.22","openshift_container_platform 4.2"],"published":"2026-05-01","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:20:05.563","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43003","references":[{"url":"https://bugs.launchpad.net/ironic-python-agent/+bug/2148310","label":"cve@mitre.org"},{"url":"https://github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py#L134-L139","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/16/11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:51038","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57801","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60446","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60454","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-43003","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464306","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43003"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43003"},{"url":"https://github.com/openstack/ironic-python-agent"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ironic-python-agent/PYSEC-2026-205.yaml"},{"url":"https://opendev.org/openstack/ironic-python-agent/commit/6cd463a657edcddf7b79416ac69bdef5b6f30099"}],"tags":["nvd","cve.org","csaf","vex","red-hat","osv","pip"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-05-01T14:13:22.620791Z"},"epss":0.00983,"epssPercentile":0.60801,"aliases":["GHSA-rmxr-45gj-889w","PYSEC-2026-205"],"ecosystem":"pip","scores":{"nvd":8,"cna":8,"vendor":8.5},"ingestedAt":"2026-07-08T18:25:52.991Z","slug":"CVE-2026-43003","body":"## Overview\n\nAn issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.\n\n## Affected\n\n- `ironic_python_agent >= 1.0.0, <= 11.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-43003)\n\nAffected packages:\n\n- `ironic-python-agent >= 1.0.0, < 11.6.0`\n\nPatched in:\n\n- `ironic-python-agent 11.6.0`\n\nSource: https://osv.dev/vulnerability/GHSA-rmxr-45gj-889w\n\n## Vendor advisories\n\n- **RHSA-2026:60454** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:60454)\n- **RHSA-2026:57801** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:57801)\n- **RHSA-2026:51038** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:51038)\n- **RHSA-2026:60446** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.2 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60446)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json)","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":201653,"id":"CVE-2026-43003","ts":1789399580976,"field":"cvss","old":"8.5","new":"8"},{"seq":200385,"id":"CVE-2026-43003","ts":1789397189272,"field":"cvss","old":"8","new":"8.5"},{"seq":198309,"id":"CVE-2026-43003","ts":1789391819818,"field":"cvss","old":"8.5","new":"8"},{"seq":196102,"id":"CVE-2026-43003","ts":1789383462903,"field":"cvss","old":"8","new":"8.5"},{"seq":195031,"id":"CVE-2026-43003","ts":1789380354872,"field":"cvss","old":"8.5","new":"8"},{"seq":193818,"id":"CVE-2026-43003","ts":1789378320286,"field":"cvss","old":"8","new":"8.5"},{"seq":192605,"id":"CVE-2026-43003","ts":1789376302104,"field":"cvss","old":"8.5","new":"8"},{"seq":191392,"id":"CVE-2026-43003","ts":1789373219232,"field":"cvss","old":"8","new":"8.5"},{"seq":190177,"id":"CVE-2026-43003","ts":1789369194270,"field":"cvss","old":"8.5","new":"8"},{"seq":188964,"id":"CVE-2026-43003","ts":1789368081518,"field":"cvss","old":"8","new":"8.5"},{"seq":187747,"id":"CVE-2026-43003","ts":1789365051279,"field":"cvss","old":"8.5","new":"8"},{"seq":186534,"id":"CVE-2026-43003","ts":1789363073992,"field":"cvss","old":"8","new":"8.5"},{"seq":185320,"id":"CVE-2026-43003","ts":1789361009918,"field":"cvss","old":"8.5","new":"8"},{"seq":184107,"id":"CVE-2026-43003","ts":1789357992441,"field":"cvss","old":"8","new":"8.5"},{"seq":182358,"id":"CVE-2026-43003","ts":1789354152214,"field":"cvss","old":"8.5","new":"8"},{"seq":181151,"id":"CVE-2026-43003","ts":1789352988745,"field":"cvss","old":"8","new":"8.5"},{"seq":179944,"id":"CVE-2026-43003","ts":1789350062309,"field":"cvss","old":"8.5","new":"8"},{"seq":178737,"id":"CVE-2026-43003","ts":1789347910933,"field":"cvss","old":"8","new":"8.5"},{"seq":177530,"id":"CVE-2026-43003","ts":1789346214798,"field":"cvss","old":"8.5","new":"8"},{"seq":176323,"id":"CVE-2026-43003","ts":1789342818746,"field":"cvss","old":"8","new":"8.5"},{"seq":175777,"id":"CVE-2026-43003","ts":1789338601995,"field":"cvss","old":"8.5","new":"8"},{"seq":175647,"id":"CVE-2026-43003","ts":1789338444171,"field":"cvss","old":"8","new":"8.5"},{"seq":174442,"id":"CVE-2026-43003","ts":1789334638838,"field":"cvss","old":"8.5","new":"8"},{"seq":173237,"id":"CVE-2026-43003","ts":1789333301950,"field":"cvss","old":"8","new":"8.5"},{"seq":172051,"id":"CVE-2026-43003","ts":1789330935328,"field":"cvss","old":"8.5","new":"8"},{"seq":170865,"id":"CVE-2026-43003","ts":1789328440617,"field":"cvss","old":"8","new":"8.5"},{"seq":169660,"id":"CVE-2026-43003","ts":1789326959297,"field":"cvss","old":"8.5","new":"8"},{"seq":168455,"id":"CVE-2026-43003","ts":1789323511249,"field":"cvss","old":"8","new":"8.5"},{"seq":167250,"id":"CVE-2026-43003","ts":1789319410449,"field":"cvss","old":"8.5","new":"8"},{"seq":166045,"id":"CVE-2026-43003","ts":1789318369899,"field":"cvss","old":"8","new":"8.5"},{"seq":164840,"id":"CVE-2026-43003","ts":1789315592132,"field":"cvss","old":"8.5","new":"8"},{"seq":163635,"id":"CVE-2026-43003","ts":1789313310700,"field":"cvss","old":"8","new":"8.5"},{"seq":162430,"id":"CVE-2026-43003","ts":1789311745885,"field":"cvss","old":"8.5","new":"8"},{"seq":161225,"id":"CVE-2026-43003","ts":1789308334607,"field":"cvss","old":"8","new":"8.5"},{"seq":160730,"id":"CVE-2026-43003","ts":1789304264333,"field":"cvss","old":"8.5","new":"8"},{"seq":158568,"id":"CVE-2026-43003","ts":1789299339629,"field":"cvss","old":"8","new":"8.5"},{"seq":157532,"id":"CVE-2026-43003","ts":1789296498293,"field":"cvss","old":"8.5","new":"8"},{"seq":156327,"id":"CVE-2026-43003","ts":1789294437798,"field":"cvss","old":"8","new":"8.5"},{"seq":155122,"id":"CVE-2026-43003","ts":1789292694785,"field":"cvss","old":"8.5","new":"8"},{"seq":153917,"id":"CVE-2026-43003","ts":1789289412884,"field":"cvss","old":"8","new":"8.5"},{"seq":152567,"id":"CVE-2026-43003","ts":1789281311904,"field":"cvss","old":"8.5","new":"8"},{"seq":148063,"id":"CVE-2026-43003","ts":1789270935082,"field":"cvss","old":"8","new":"8.5"},{"seq":146103,"id":"CVE-2026-43003","ts":1789269199340,"field":"cvss","old":"8.5","new":"8"},{"seq":145006,"id":"CVE-2026-43003","ts":1789266160454,"field":"cvss","old":"8","new":"8.5"},{"seq":143910,"id":"CVE-2026-43003","ts":1789262500653,"field":"cvss","old":"8.5","new":"8"},{"seq":142746,"id":"CVE-2026-43003","ts":1789261251211,"field":"cvss","old":"8","new":"8.5"},{"seq":141582,"id":"CVE-2026-43003","ts":1789258650478,"field":"cvss","old":"8.5","new":"8"},{"seq":140384,"id":"CVE-2026-43003","ts":1789256446989,"field":"cvss","old":"8","new":"8.5"},{"seq":139186,"id":"CVE-2026-43003","ts":1789254631938,"field":"cvss","old":"8.5","new":"8"},{"seq":137988,"id":"CVE-2026-43003","ts":1789251633224,"field":"cvss","old":"8","new":"8.5"}]}