Executive brief
OpenStack Ironic Python Agent is a component used to provision and manage physical servers (bare metal) in cloud environments. A security flaw allows a user with administrative 'manager' privileges to execute unauthorized commands on the server during its startup process. This could allow an attacker to take full control of the server being provisioned, potentially leading to data theft or service disruption on that specific machine.
Technical details
An OS command injection vulnerability (CWE-78) exists in the OpenStack Ironic Python Agent (IPA) through version 11.6.0. The root cause is the lack of sanitization for the 'ntp_server' configuration value, which is passed directly to a shell command when executing chronyd during the early startup flow. An attacker with 'manager' role privileges can exploit this by providing a maliciously crafted NTP server string via kernel parameters or mDNS responses. Successful exploitation allows for arbitrary command execution as the root user on the running IPA ramdisk. Patches have been released across multiple OpenStack branches (Antelope through Hibiscus) to switch from shell-based execution to direct execution.
Affected products
- OpenStack Ironic Python Agent 6.0.0 to 10.2.3, 11.0.0 to 11.2.1, 11.3.0 to 11.5.1, 11.6.0
Timeline
- 2026-07-07: disclosed: Bug reported to OpenStack by Metal3.io security team
- 2026-07-23: advisory: OpenStack Security Advisory OSSA-2026-027 published
- 2026-07-24: patched: CVE published and patches made available across multiple branches