Executive brief
A vulnerability in the OpenStack Ironic Python Agent allows a malicious container image to steal administrative credentials used for downloading software. This occurs when the system is configured to deploy 'bootc' containers, which are used to provision bare-metal servers. An attacker who can provide a custom container image can capture sensitive registry passwords, potentially gaining unauthorized access to private software repositories across the entire cloud environment.
Technical details
A vulnerability exists in the Ironic Python Agent (IPA) bootc deployment path where sensitive OCI pull secrets are exposed to the tenant-controlled container. When deploying a bootc image, IPA writes registry credentials to a local auth.json file and executes Podman with the '--privileged' and '--pid=host' flags. Because the container shares the host's PID namespace, malicious code within the container can traverse the /proc filesystem (specifically /proc/1/root/) to read the authentication file from the host's filesystem. This allows a low-privileged user capable of triggering a deployment to capture administrative or conductor-wide registry credentials. The issue is addressed in various bugfix branches including 11.6, 11.4, and 11.3.
Affected products
- OpenStack Ironic Python Agent >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1
Timeline
- 2026-06-08: disclosed: Bug reported on Launchpad
- 2026-07-23: advisory: OpenStack Security Advisory OSSA-2026-028 published
- 2026-07-24: other: CVE-2026-54422 published to NVD