In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running… (CVE-2026-66138)
Affects ironic-python-agentSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEs
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu:24.04:LTSironic-python-agentpkg:deb/ubuntu/ironic-python-agent?arch=source&distro=nobleOther threats | Affected
| Fixed in– |
Ubuntu:26.10ironic-python-agentpkg:deb/ubuntu/ironic-python-agent?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu:26.04:LTSironic-python-agentpkg:deb/ubuntu/ironic-python-agent?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
No explicit patch or remediation is provided in the available data. Until a fix is available, restrict project-scoped users with the manager role from modifying the ntp_server configuration or running untrusted configurations.
Description
OpenStack Ironic Python Agent versions up to and including 11.6.0 contain a vulnerability where a project-scoped user with the manager role can execute arbitrary code on a running agent. This occurs because the ntp_server configuration value is passed directly to a shell without proper sanitization, allowing command injection. The vulnerability has a CVSS score of 7.2, indicating a medium severity level.
Summary
CVE-2026-66138 affects OpenStack Ironic Python Agent through version 11.6.0. A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic Python Agent instance by supplying a maliciously crafted ntp_server configuration value. This value is passed to a shell command without adequate validation or sanitization, leading to command injection. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
Impact
Successful exploitation allows a project-scoped user with manager privileges to execute arbitrary code on the host running the Ironic Python Agent. This can lead to full compromise of the agent process and potentially the underlying system, impacting confidentiality, integrity, and availability.
Weaknesses
References
- bugs.launchpad.net/ironic-python-agent/+bug/2160050 (opens in a new tab)
- security.openstack.org/ossa/OSSA-2026-027.html (opens in a new tab)
- openwall.com/lists/oss-security/2026/07/24/26 (opens in a new tab)
- ubuntu.com/security/CVE-2026-66138 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-66138 (opens in a new tab)
- openwall.com/lists/oss-security/2026/07/23/5 (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.