CVE-2026-54422: [OSSA-2026-028] OpenStack Ironic Python Agent: Cdential extraction via malicious container (CVE-2026-54422)
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54422?
The severity of CVE-2026-54422 is medium with a score of 5.5.
How do I fix CVE-2026-54422?
To fix CVE-2026-54422, consider upgrading to the latest version of OpenStack Ironic Python Agent beyond 11.5.0 to mitigate the vulnerability.
What is CVE-2026-54422 about?
CVE-2026-54422 details a vulnerability in OpenStack Ironic Python Agent that allows a malicious container to extract credentials used during deployment.
What systems are affected by CVE-2026-54422?
CVE-2026-54422 affects versions of the OpenStack Ironic Python Agent up to and including 11.5.0.
What actions should be taken to secure against CVE-2026-54422?
To secure against CVE-2026-54422, ensure that containers deployed using the ironic-python-agent are from trusted sources and consider implementing stricter access controls.