CVE-2026-43003: OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere
(updated )
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
References
- access.redhat.com/errata/RHSA-2026:51038
- access.redhat.com/errata/RHSA-2026:57801
- access.redhat.com/errata/RHSA-2026:60446
- access.redhat.com/errata/RHSA-2026:60454
- access.redhat.com/security/cve/CVE-2026-43003
- bugs.launchpad.net/ironic-python-agent/+bug/2148310
- bugzilla.redhat.com/show_bug.cgi?id=2464306
- github.com/advisories/GHSA-rmxr-45gj-889w
- github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py
- github.com/pypa/advisory-database/tree/main/vulns/ironic-python-agent/PYSEC-2026-205.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-43003
- opendev.org/openstack/ironic-python-agent/commit/6cd463a657edcddf7b79416ac69bdef5b6f30099
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json
Code Behaviors & Features
Detect and mitigate CVE-2026-43003 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →