CVE-2026-66138
Description
A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.
Statement
Red Hat OpenStack Platform ships ironic-python-agent as part of bare metal provisioning. Deployments using chrony for time synchronization in the IPA ramdisk are affected by this vulnerability. The impact is limited to the bare metal node running the IPA ramdisk; there is no known method for leveraging ramdisk shell access to compromise the Ironic control plane service.
In RHOSP 18.0 (Ironic 21.0+), a user with the project-scoped Manager role and node ownership can set kernel command line parameters that include a malicious ipa-ntp-server value. The Manager role is a delegated, limited-scope role introduced in Ironic 21.0.0; a manager-scoped user cannot change base service configuration or templates, cannot access nodes in other projects, and cannot pivot the attack beyond their isolated project scope.
In RHOSP 17.1 (Ironic <21.0), the Manager role does not exist. Exploitation requires either a user with the admin role, or manually starting the agent outside of Ironic's context to trigger the mDNS configuration loading path, which is not a default deployment configuration.
The mDNS attack vector is related to legacy Kubernetes Native Infrastructure efforts and is not in a standard deployment path.
Mitigation
Remove the chronyd binary from the Ironic Python Agent (IPA) ramdisk image. The vulnerable code path is only reached when chronyd is detected as available. Without chronyd, IPA will either use ntpdate for time synchronization (which is not affected by this vulnerability, as it passes the NTP server address as a separate process argument without shell interpolation) or skip time synchronization entirely if neither tool is available. Additionally, restrict and segment the provisioning network to prevent rogue mDNS responders, and review OpenStack RBAC policies to limit which users can modify kernel_append_params on bare metal nodes.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 7.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Network-accessible via Ironic API (AV:N), no special conditions (AC:L), requires Manager role in RHOSP 18.0 which is a delegated limited-scope role not providing significant control over the component (PR:L), no user interaction (UI:N), impact limited to bare metal node (S:U), root command execution gives full C/I/A impact. Worst-case scenario scored: RHOSP 18.0 Manager role can trigger this without admin privileges.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Acknowledgements
This issue was discovered by Dmitry Tantsur (Red Hat (Metal3.io Security Team)) and Tuomo Tanskanen (Ericsson Software Technology (Metal3.io Security Team)). Upstream acknowledges Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) as the original reporters.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
