8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43003

CVE-2026-43003: OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43003

CVE-2026-43003:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ironic-python-agent	pip	>= 1.0.0, <= 11.5.0	11.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because ironic-python-agent executes grub-install from a user-provided partition image within a chroot. A malicious user can provide a crafted image with a malicious grub-install binary, which will then be executed with root privileges in the context of the ironic-python-agent.

The function _run_grub_install in ironic_python_agent/efi_utils.py is directly responsible for executing the grub-install command. It constructs the command and executes it using utils.execute.

The function Image.install_bootloader in ironic_python_agent/extensions/image.py is the high-level function that initiates the bootloader installation process for partition images. The patch that mitigates the vulnerability by adding a configuration flag to disable partition images is applied to this function. This indicates that this function is the entry point for the vulnerable code path.

The stack trace during exploitation would likely contain both of these functions.

Vulnerable functions

_run_grub_install

ironic_python_agent/efi_utils.py

This function is responsible for executing the `grub-install` command. It takes a `chroot` parameter and executes the command within that chroot. A malicious user can provide a crafted image with a malicious `grub-install` binary, which will then be executed with root privileges in the context of the `ironic-python-agent`.

Image.install_bootloader

ironic_python_agent/extensions/image.py

This function is the high-level function that initiates the bootloader installation process for partition images. It is the entry point for the vulnerable code path that leads to the execution of the malicious `grub-install` binary.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.