CVE-2026-43003
Fixed in a distro release EPSS <1%CVSS 8.0
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
Products: OpenStack ironic-python-agent, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Container Platform 4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ironic-python-agent | 11.6.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ironic | 1:21.4.4-0+deb12u2 |
| Debian 13 | ironic | 1:29.0.5-0+deb13u3 |
| Debian 13 | ironic-python-agent | no fix |
| Debian 14 | ironic | 1:35.0.1-7 |
| Debian 14 | ironic-python-agent | 11.5.0-3 |
| Ubuntu 24.04 LTS | ironic-python-agent | no fix |
| Ubuntu 25.10 | ironic-python-agent | no fix |
| Ubuntu 26.04 LTS | ironic-python-agent | no fix |
| Ubuntu 26.10 | ironic-python-agent | no fix |