CVE-2026-66138 PUBLISHED

Assigner: mitre
Reserved: 24.07.2026 Published: 24.07.2026 Updated: 24.07.2026

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor OpenStack
Product Ironic Python Agent
Versions Default: unaffected
  • Version 11.6.0 is affected
  • affected from 11.3.0 to 11.5.1 (incl.)
  • affected from 11.0.0 to 11.2.1 (incl.)
  • affected from 6.0.0 to 10.2.3 (incl.)

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE