CVE-2026-54422 | In OpenStack Ironic Python Agent through 11.5.0, a malicious… | CVSS 5.5 MEDIUM

Description

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

Metadata

CVE ID: CVE-2026-54422
State: PUBLISHED
Assigner: mitre
Reserved: 2026-06-14 03:57 UTC
Published: 2026-07-24 03:42 UTC
Last updated: 2026-07-24 05:07 UTC
Primary CWE: CWE-522
CWE-522 Insufficiently Protected Credentials
Vendor / Product: OpenStack / Ironic Python Agent
Sources: cve.org · NVD

Severity & Metrics

5.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
OpenStack	Ironic Python Agent	—	10.2.0 < 10.2.3, 11.0.0 < 11.2.1, 11.3.0 < 11.5.1

Weakness (CWE)

CWE	Source	Description
CWE-522	cna	CWE-522 Insufficiently Protected Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.5	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

References (3)