UNKNOWN OpenStack
CVE-2026-43003
OSSN-0100: OSSN-0100
Tuomo Tanskanen (Ericsson Software Technology) and Dmitry Tantsur (Red Hat)
from the Metal3.io Security Team reported a vulnerability in Ironic Python
Agent (IPA) when deploying a partition image that lacks boot artifacts.
A malicious partition image can include crafted grub-install
binary or other arbitrary binaries in the chroot path which IPA executes on
the provisioning network host. This affects all partition images that
require Ironic to manage the bootloader installation (BIOS-booted node
Affected Products
- ironic: <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.0
- ironic-python-agent: <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1
- CVE-2026-43003
References
This unknown severity vulnerability was published on 2026-06-16 via OpenStack. Affected: ironic: <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.0, ironic-python-agent: <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1, CVE-2026-43003.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.