# CVE-2026-43003: OpenStack Ironic Python Agent command injection via malicious image

Source: https://junglewise.ai/threats/cve-2026-43003-openstack-ironic-python-agent-command-injection-via-malicious  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-43003 · Severity: high · CVSS 8 · Published 2026-05-01

OpenStack Ironic Python Agent, a component used for provisioning bare-metal servers, contains a vulnerability that allows for arbitrary code execution. An attacker who can provide a malicious operating system image can trick the provisioning agent into executing harmful code during the bootloader installation process. This could lead to a compromise of the provisioning host, though the impact is somewhat mitigated by existing network safeguards and limited access to sensitive tokens.

Technologies: [OpenStack Ironic](https://junglewise.ai/threats/technologies/ironic). Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-43003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43003 being exploited in the wild.

**How severe is CVE-2026-43003?** High severity, with a CVSS score of 8, published 1 May 2026.

**Which products and versions are affected?** OpenStack Ironic < 10.2.3, >= 11.0.0 < 11.2.1, >= 11.3.0 < 11.5.1; ironic-python-agent (PyPI) >= 1.0.0, <= 11.5.0, ECOSYSTEM:introduced=1.0.0,fixed=11.6.0.

**Is there a fix for CVE-2026-43003?** Yes. ironic-python-agent (PyPI): upgrade to 11.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43003 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-43003?** Check whether you run OpenStack Ironic or ironic-python-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ironic-python-agent (PyPI): upgrade to 11.6.0 or later

  ```sh
  pip install "ironic-python-agent>=11.6.0"
  ```


## Technical details

A command injection vulnerability exists in the OpenStack Ironic Python Agent (IPA) due to the insecure execution of binaries from within a chroot environment. When deploying a partition image that requires Ironic to manage bootloader installation (specifically BIOS-booted nodes without boot artifacts), IPA may execute 'grub-install' or other binaries located within the tenant-provided image. An attacker can supply a malicious partition image containing a crafted binary in the chroot path, leading to arbitrary code execution on the provisioning network host. While the vulnerability is high severity, exploitation requires the attacker to have permissions to provide deployment images and is limited by the fact that the agent typically holds redacted node objects and outdated tokens at the time of execution. Patches have been released to make this behavior optional and disabled by default.

## Affected products

- OpenStack ironic-python-agent < 10.2.3, >= 11.0.0 < 11.2.1, >= 11.3.0 < 11.5.1
- OpenStack ironic < 29.0.6, >= 30.0.0 < 32.0.2, >= 33.0.0 < 35.0.2, >= 36.0.0 < 37.0.0
- Red Hat OpenShift Container Platform 4

## Identifiers

- CVE-2026-43003
- GHSA-rmxr-45gj-889w
- PYSEC-2026-205

## Timeline

- 2026-05-01: disclosed
- 2026-05-01: advisory
- 2026-06-16: other: Detailed technical advisory published via Openwall

## References

- [https://bugs.launchpad.net/ironic-python-agent/+bug/2148310](https://bugs.launchpad.net/ironic-python-agent/+bug/2148310)
- [https://github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py](https://github.com/openstack/ironic-python-agent/blob/236b33abffe6688afc39c21e351cc3889b3db2dd/ironic_python_agent/efi_utils.py)
- [http://www.openwall.com/lists/oss-security/2026/06/16/11](http://www.openwall.com/lists/oss-security/2026/06/16/11)
- [https://access.redhat.com/security/cve/CVE-2026-43003](https://access.redhat.com/security/cve/CVE-2026-43003)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2464306](https://bugzilla.redhat.com/show_bug.cgi?id=2464306)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43003.json)

## Related threats

- [OpenStack Ironic path injection in Redfish vendor_passthru](https://junglewise.ai/threats/cve-2026-90458-openstack-ironic-before-39-0-1-allows-delete-and-get-via-vendor)
- [OpenStack Ironic authorization bypass in node maintenance setting](https://junglewise.ai/threats/cve-2026-89419-openstack-ironic-before-39-0-1-sometimes-allows-a-user-to-change)
- [OpenStack Ironic denial of service via gzip bomb in configdrive](https://junglewise.ai/threats/cve-2026-115638-openstack-ironic-through-39-0-1-allows-a-denial-of-service-via-a)
- [OpenStack Ironic credential leakage in HTTP Basic Authentication](https://junglewise.ai/threats/cve-2026-90461-openstack-ironic-credential-leakage-in-http-basic-authentication)
- [OpenStack Ironic autodetect deploy interface cleaning bypass](https://junglewise.ai/threats/cve-2026-74250-openstack-ironic-autodetect-deploy-interface-cleaning-bypass)