Skip to content
Fencer Vulns
high 7.2

CVE-2026-66138 json

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a runn…

published 2026-07-24 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-48476

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

Patch / fix

  • ironic-python-agent Debian 14 11.5.0-4

debian advisories DEBIAN-CVE-2026-66138

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-66138 updated cvss 8.8

ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration

  • Red Hat OpenShift Container Platform 4 python3-ironic-python-agent, openstack-ironic-python-agent Red Hat OpenStack Platform 17.1 python3-ironic-python-agent, openstack-ironic-python-agent Red Hat OpenStack Platform 18.0 openstack-ironic-python-agent
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ironic-agent-rhel9 1791836939
    fixed: vendor fix RHSA-2026:82785
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-agent-rhel9 1791834878
    fixed: vendor fix RHSA-2026:82813
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-ironic-agent-rhel9 1789449407
    fixed: vendor fix RHSA-2026:67936
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-ironic-agent-rhel9 1790073533
    fixed: vendor fix RHSA-2026:70587
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-ironic-agent-rhel9 1788575439
    fixed: vendor fix RHSA-2026:65852
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-ironic-agent-rhel9 1788338739
    fixed: vendor fix RHSA-2026:63047
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-ironic-agent-rhel9 1787735456
    fixed: vendor fix RHSA-2026:60446
show 3 more
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-ironic-agent-rhel9 1787555677
    fixed: vendor fix RHSA-2026:60477
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-ironic-agent-rhel9 1787073364
    fixed: vendor fix RHSA-2026:57365
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1791838793, openshift4/ose-pod 1791842699, openshift4/ose-tests 1791781968, openshift4/ose-console 1791842061, openshift4/ose-coredns 1791842976, openshift4/ose-deployer 1791843620, +189 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1791878476, openshift4/ose-tests 1791889482, openshift4/ose-console 1791836468, openshift4/ose-deployer 1791888334, openshift4/ose-installer 1791889788, openshift4/ose-pod-rhel9 1791639781, +184 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1789361923, openshift4/ose-pod-rhel9 1789370561, openshift4/ose-sdn-rhel9 1789376367, openshift4/ose-etcd-rhel9 1789369183, openshift4/ose-tests-rhel9 1789368515, openshift4/ose-tools-rhel9 1789366012, +182 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1789938330, openshift4/ose-cli-rhel9 1789937904, openshift4/ose-pod-rhel9 1789937463, openshift4/ose-etcd-rhel9 1789937632, openshift4/ose-tests-rhel9 1790075131, openshift4/ose-tools-rhel9 1790073665, +180 more Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1788576352, openshift4/ose-cli-rhel9 1788576309, openshift4/ose-pod-rhel9 1788575535, openshift4/ose-etcd-rhel9 1788576053, openshift4/ose-tests-rhel9 1788579480, openshift4/ose-tools-rhel9 1788576163, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1788311982, openshift4/ose-cli-rhel9 1788311429, openshift4/ose-pod-rhel9 1788311898, openshift4/ose-etcd-rhel9 1788318849, openshift4/ose-tests-rhel9 1788340321, openshift4/ose-tools-rhel9 1788338367, +180 more
    +4 more products
    Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1787736001, openshift4/ose-cli-rhel9 1787735982, openshift4/ose-pod-rhel9 1787736197, openshift4/ose-etcd-rhel9 1787736773, openshift4/ose-tests-rhel9 1787737933, openshift4/ose-tools-rhel9 1787736243, +184 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1787555870, openshift4/ose-cli-rhel9 1787556246, openshift4/ose-pod-rhel9 1787558631, openshift4/ose-etcd-rhel9 1787562282, openshift4/ose-tests-rhel9 1787563149, openshift4/ose-tools-rhel9 1787557205, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1786964976, openshift4/ose-cli-rhel9 1786965815, openshift4/ose-pod-rhel9 1787118353, openshift4/ose-etcd-rhel9 1786971601, openshift4/ose-tests-rhel9 1787012092, openshift4/ose-tools-rhel9 1787010320, +182 more Red Hat OpenStack Platform 16.2 python3-ironic-python-agent, openstack-ironic-python-agent
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • OpenStack Ironic Python Agent

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.