UNKNOWN OpenStack
CVE-2026-54422
OSSA-2026-028: Credential extraction from Ironic Python Agent via malicious container
Yuliang Xiao reported a vulnerability in Ironic Python Agent’s bootc container deployment support. A malicious container can extract the secrets used to fetch from the OCI registry on deployment. Operators can fix this issue by applying the provided patches or completely disabling the bootc deploy_interface on their Ironic conductors. Any Ironic user with the ability to deploy arbitrary containers from the bootc deploy_interface can exploit this. Patches ¶ https://review.opendev.org/998485 (2025
Affected Products
- Ironic-python-agent: >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1
- CVE-2026-54422
References
- https://security.openstack.org/ossa/OSSA-2026-028.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-54422
This unknown severity vulnerability was published on 2026-07-23 via OpenStack. Affected: Ironic-python-agent: >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1, CVE-2026-54422.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.