Vulnerability Description
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Ironic Python Agent | >= 1.0.0, <= 11.5.0 |
Related Weaknesses (CWE)
References
- https://bugs.launchpad.net/ironic-python-agent/+bug/2148310Issue Tracking
- https://github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e35Product
- http://www.openwall.com/lists/oss-security/2026/06/16/11
- https://access.redhat.com/errata/RHSA-2026:51038
- https://access.redhat.com/security/cve/CVE-2026-43003
- https://bugzilla.redhat.com/show_bug.cgi?id=2464306
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json
FAQ
What is CVE-2026-43003?
CVE-2026-43003 is a vulnerability with a CVSS score of 8.0 (HIGH). An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading t...
How severe is CVE-2026-43003?
CVE-2026-43003 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-43003?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Ironic Python Agent.