Openstack Ironic Python Agent vulnerabilities

3 CVEs affecting Openstack Ironic Python Agent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66138, published 2026-07-24.

More from Openstack.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-43003, published 2026-05-01. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading…
• CVE-2026-66138, published 2026-07-24. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed…
• CVE-2026-54422, published 2026-07-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.