CVE-2026-43003 | Vulnetix

CVE-2026-43003 PUBLISHED CVSS 8 HIGH

Reported by mitre · Published May 1, 2026

An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.

EPSS 0.82% · 54.7th percentile

Risk Scores

CVSS 3.1

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score

0.82%

54.7th percentile

Affected Products

Vendor	Product	Versions
OpenStack	ironic-python-agent	1.0.0
OpenStack	ironic-python-agent	1.0.0

Timeline

May 1, 2026 CVE Published
May 1, 2026 PoC Published
May 7, 2026 CVE Updated
May 18, 2026 EPSS Score
May 19, 2026 EPSS Score
May 20, 2026 EPSS Score
May 21, 2026 EPSS Score
May 22, 2026 EPSS Score
May 23, 2026 EPSS Score
May 24, 2026 EPSS Score
May 25, 2026 EPSS Score
May 26, 2026 EPSS Score

References

Open in Interactive Console →