CVE-2026-54422: Ironic Python Agent Info Disclosure Flaw

CVE-2026-54422 Overview

CVE-2026-54422 affects OpenStack Ironic Python Agent (IPA) versions through 11.5.0. A malicious bootc container, when deployed using ironic-python-agent, may extract the credentials used to download it. The flaw falls under insufficiently protected credentials [CWE-522] and exposes registry authentication material to attacker-controlled container content.

The issue affects bare-metal provisioning workflows where operators pull container images from authenticated registries. An attacker who controls a container image referenced during deployment can harvest the download credentials at runtime.

Critical Impact
Malicious bootc containers deployed through ironic-python-agent can exfiltrate registry credentials used to fetch the image, enabling downstream compromise of container registries and connected deployment pipelines.

Affected Products

OpenStack Ironic Python Agent versions up to and including 11.5.0
Bare-metal provisioning workflows using bootc container deployment
OpenStack environments relying on authenticated container registries for Ironic image pulls

Discovery Timeline

2026-07-24 - CVE-2026-54422 published to NVD
2026-07-24 - OpenStack Security Advisory OSSA-2026-028 referenced
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-54422

Vulnerability Analysis

OpenStack Ironic Python Agent orchestrates bare-metal node provisioning, including deployment of bootc-based container images. During deployment, IPA authenticates to a container registry to download the requested image. The credentials used for that pull are made accessible in a context where the container itself can read them.

When the deployed image is attacker-controlled, code executing inside the container can enumerate the environment and extract those registry credentials. The vulnerability is categorized as insufficiently protected credentials [CWE-522]. Exploitation requires that an operator initiate deployment of a malicious image, which aligns with the required user interaction and high attack complexity reflected in the scoring vector.

Root Cause

The root cause is credential handling during the bootc container deployment flow. IPA does not sufficiently isolate the registry authentication material from the container runtime context. Credentials that should remain scoped to the pull operation persist or become readable within the container filesystem or process environment after image instantiation.

Attack Vector

The attack requires local access to the provisioning workflow and user interaction to select or approve a malicious container image. An attacker publishes a bootc image to a registry accessible to the Ironic operator, or convinces the operator to deploy an attacker-supplied reference. When IPA pulls the image using stored credentials and hands off to the container, code inside the container reads the credentials from the exposed context and exfiltrates them. The scope change reflects that stolen credentials grant access to a separate security authority — the container registry — beyond the compromised bare-metal node.

No exploitation code is publicly available. See the OpenStack Security Advisory and the Launchpad Bug Report for technical details.

Detection Methods for CVE-2026-54422

Indicators of Compromise

Unexpected outbound network connections from freshly deployed bare-metal nodes to non-registry endpoints during first boot.
Access to files or environment variables containing registry authentication tokens by processes inside deployed bootc containers.
Registry audit logs showing image pulls from unfamiliar credentials or IP ranges shortly after a provisioning event.

Detection Strategies

Monitor ironic-python-agent deployment logs for image references pointing to unverified or newly created registries.
Audit bootc container manifests for unexpected entrypoints or scripts that read authentication configuration such as /run/containers/auth.json or REGISTRY_AUTH_FILE.
Correlate provisioning events with subsequent authentication activity against the container registry to detect credential reuse from unfamiliar sources.

Monitoring Recommendations

Enable registry-side access logging and alert on token reuse from IP addresses outside the Ironic control plane.
Track process execution and file reads inside deployed bare-metal images during the first-boot window.
Alert on any modification to registry credential files during or after container instantiation.

How to Mitigate CVE-2026-54422

Immediate Actions Required

Restrict bootc container deployments to a curated allowlist of trusted images and registries maintained by the platform team.
Rotate registry credentials used by ironic-python-agent if any deployment of an untrusted image has occurred on affected versions.
Use short-lived, scoped registry tokens rather than long-lived credentials for IPA image pulls.

Patch Information

Refer to OSSA-2026-028 and the Launchpad Bug Report for the fix version and upgrade guidance. Upgrade ironic-python-agent beyond version 11.5.0 to the patched release identified in the advisory. Additional discussion is available on the Openwall OSS-Security list.

Workarounds

Deploy only signed, internally reviewed bootc images until the patched IPA version is installed.
Use anonymous or unauthenticated registry mirrors for provisioning workflows where feasible, eliminating the exposed credential.
Isolate the provisioning network so that deployed nodes cannot reach arbitrary external endpoints during first boot, limiting exfiltration paths.

bash

# Configuration example: use a short-lived, scoped pull token for IPA
# Generate a registry token limited to read:pull scope and a short TTL
# then reference it from ironic-python-agent configuration

[agent]
image_download_source = http
container_registry_auth_file = /etc/ironic-python-agent/scoped-auth.json

# scoped-auth.json should contain a read-only, short-lived token
# rotate on every provisioning cycle