Medium severity5.5NVD Advisory· Published Jul 24, 2026· Updated Jul 24, 2026

CVE-2026-54422

Description

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

Affected products

OpenStack/Ironic Python Agentinferred2 versions
<=11.5.0+ 1 more
- (no CPE)range: <=11.5.0
- (no CPE)range: <=11.5.0

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/07/23/4nvd
bugs.launchpad.net/ironic-python-agent/+bug/2155826nvd
security.openstack.org/ossa/OSSA-2026-028.htmlnvd
www.openwall.com/lists/oss-security/2026/07/23/4nvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000