CVE-2026-43003

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43003
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43003.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-43003
Aliases
Downstream
Published
2026-05-01T00:00:00Z
Modified
2026-07-08T08:13:59.058481720Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "10.2.3"
                },
                {
                    "introduced": "11.0.0"
                },
                {
                    "fixed": "11.2.1"
                },
                {
                    "introduced": "11.3.0"
                },
                {
                    "fixed": "11.5.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43003.json",
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-829"
    ]
}
References

Affected packages

Git / github.com/openstack/ironic-python-agent

Affected ranges

Type
GIT
Repo
https://github.com/openstack/ironic-python-agent
Events
Introduced
0144e79df5dab0837a55a981fa23298908af14cf
Fixed
236b33abffe6688afc39c21e351cc3889b3db2dd
Database specific 
{
    "source": [
        "DESCRIPTION",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:openstack:ironic_python_agent:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "11.5.0"
        },
        {
            "last_affected": "11.5.0"
        }
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
10.*
10.0.0
10.1.0
10.2.0
11.*
11.0.0
11.1.0
11.2.0
11.3.0
11.4.0
2.*
2.0.0
2.1.0
2.2.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
4.*
4.0.0
5.*
5.0.0
6.*
6.0.0
6.1.0
6.2.0
6.3.0
6.4.0
6.5.0
6.6.0
7.*
7.0.0
8.*
8.0.0
8.1.0
8.2.0
8.3.0
8.4.0
8.5.0
8.6.0
9.*
9.0.0
9.1.0
9.10.0
9.12.0
9.13.0
9.14.0
9.2.0
9.3.0
9.4.0
9.5.0
9.6.0
9.7.0
9.8.0
9.9.0
bugfix-9.*
bugfix-9.2-eol

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43003.json"