Source: ironic-python-agent Version: 10.2.0-3 Severity: important Tags: patch security X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce: ===================================================================================== OSSA-2026-028: Credential extraction from Ironic Python Agent via malicious container ===================================================================================== :Date: July 23, 2026 :CVE: CVE-2026-54422 Affects ~~~~~~~ - Ironic-python-agent: >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1 Description ~~~~~~~~~~~ Yuliang Xiao reported a vulnerability in Ironic Python Agent's bootc container deployment support. A malicious container can extract the secrets used to fetch from the OCI registry on deployment. Operators can fix this issue by applying the provided patches or completely disabling the bootc deploy_interface on their Ironic conductors. Any Ironic user with the ability to deploy arbitrary containers from the bootc deploy_interface can exploit this. Patches ~~~~~~~ - https://review.opendev.org/998479 (2026.2/hibiscus (development)) - https://review.opendev.org/998481 (2026.1/gazpacho) - https://review.opendev.org/998484 (2025.2/flamingo) - https://review.opendev.org/998485 (2025.1/epoxy) - https://review.opendev.org/998480 (bugfix/11.6) - https://review.opendev.org/998493 (bugfix/11.4) - https://review.opendev.org/998494 (bugfix/11.3) Credits ~~~~~~~ - Yuliang Xiao References ~~~~~~~~~~ - https://launchpad.net/bugs/2155826 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54422 Notes ~~~~~ - Ironic Python Agent bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
