CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)

CWE

CWE-522

Published

2026-07-24

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://bugs.launchpad.net/ironic-python-agent/+bug/2155826
• https://security.openstack.org/ossa/OSSA-2026-028.html
• https://www.openwall.com/lists/oss-security/2026/07/23/4
• http://www.openwall.com/lists/oss-security/2026/07/23/4

Check your stackJSON