high7.2
CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Ag…
Impact
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| OpenStack | OpenStack Ironic Python Agent | through 11.6.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.