CVE-2026-43003

Executive Summary

CVE-2026-43003 is a privilege escalation and remote code execution vulnerability in OpenStack's ironic-python-agent (IPA) affecting versions 1.0.0 through 11.5.0. The flaw arises when IPA executes grub-install from within a chroot of a deployed partition image, allowing a malicious image to achieve code execution in the context of the IPA process. An attacker who can supply or influence a deployment image — either as a tenant in a multi-tenant OpenStack environment or via a compromised image repository — can achieve remote code execution on the bare metal node being provisioned, with the privileges of the IPA agent (typically root). The vulnerability carries a CVSS score of 8.0 (High) and has been assigned CWE-250 (Execution with Unnecessary Privileges). Given the broad version range and the criticality of bare metal infrastructure in cloud environments, immediate patching and image validation measures are strongly recommended.

Technical Analysis

The vulnerability resides in the image deployment workflow of ironic-python-agent, the component responsible for managing the provisioning of bare metal nodes in OpenStack Ironic. When IPA deploys a partition image — as opposed to a whole-disk image — it mounts the uploaded image's root filesystem and enters it via chroot to perform post-deployment configuration tasks. This includes executing grub-install, which installs the GRUB bootloader onto the target disk.

The core issue is a command injection via chroot escape combined with naming constraints that leave directories accessible to attacker-controlled content. During the GRUB installation phase, IPA constructs a GRUB configuration and executes grub-install while the process's root directory is changed to the mounted partition image. Crucially, the grub-install utility, when executed inside a chroot, may resolve certain file paths (e.g., /dev, /boot, or font/theme files) relative to the chrooted environment. However, because IPA does not properly sanitize the image's directory structure or the device nodes exposed within it, a malicious image can place crafted files — such as a modified grub.cfg, symlinks, or even provide a malicious ld.so.preload — that influence the behavior of grub-install.

More specifically, the flaw involves the absence of --no-floppy and other defensive flags, combined with unsafe handling of the chroot environment. GRUB, when run inside a chroot, still interacts with the host's device mapper state and can execute helpers scripts. An attacker controlling the image can create a malicious executable file at a path that grub-install invokes (e.g., an alternative grub-mkconfig script, or a modified /etc/grub.d/ script that grub-install sources). Since IPA runs as root, these helper scripts execute with full root privileges on the host bare metal node, not within the chroot, escaping the sandbox. This yields complete control of the physical server.

The attack surface is the OpenStack Ironic API endpoint, which accepts image uploads from tenants. In a multi-tenant deployment, any tenant with the ability to create a node with a custom deploy image or to upload a partition image for deployment can trigger the vulnerable code path. The vulnerability is exploitable without authentication only if the Ironic API is exposed unauthenticated (unlikely but possible in misconfigured deployments); standard exploitation assumes a valid tenant account.

Exploitation Scenarios

The following chain describes how an attacker with a tenant account in an OpenStack environment exploits CVE-2026-43003:

1. Reconnaissance / Target Identification: The attacker enumerates the OpenStack Ironic API (https://<controller>:6385/v1/nodes) to identify available bare metal nodes and the deployment workflow. Using standard OpenStack CLI or direct API calls, they confirm that the Ironic service accepts custom partition images. They also gather the node's instance_uuid and ensure their project has permission to provision nodes.

2. Malicious Image Construction: The attacker creates a malicious partition image containing a valid Linux root filesystem. Inside the image, they place the following:

   • A crafted /etc/grub.d/10_linux script (or any executable in /etc/grub.d/) that contains a command to drop a reverse shell or write an SSH authorized key. GRUB's grub-mkconfig sources these scripts during bootloader installation.
   • A symlink at /dev/sda pointing to a device file that grub-install will write to, ensuring their script is executed during the GRUB installation phase.
   • An optional ld.so.preload in the image's /etc/ that loads a malicious shared library when grub-install executes, triggering code execution before any GRUB-specific logic runs.
   • The image is built to appear as a standard Ubuntu/CentOS partition image to bypass basic validation, with a minimal toolchain and no obvious anomalies in file permissions.

3. Deployment Trigger: The attacker uploads the malicious image to the OpenStack Glance image service via openstack image create --disk-format raw --container-format bare malicious-image, then associates it with a deployment via the Ironic API: POST /v1/nodes/{node_id}/states/provision with {"target": "active", "instance_info": {"image_source": "<image_uuid>"}}. This triggers IPA to begin the deployment process: it mounts the image's root partition, chroots, and runs grub-install.

4. Payload Execution: When IPA executes grub-install inside the chroot, the utility invokes grub-mkconfig, which sources the malicious /etc/grub.d/ scripts. The attacker's script executes as root on the host bare metal node (not inside the chroot) because GRUB's helper utilities traverse back to the host's /proc and /dev mounts. The reverse shell connects back to the attacker's C2 server, or the SSH key is written to /root/.ssh/authorized_keys on the host's actual filesystem. The attacker now has root shell access on the bare metal server.

5. Post-Exploitation: With root on the bare metal node, the attacker pivots to the tenant network, accesses the node's IPMI/BMC via the local network for persistence, extracts any data from attached storage (potentially other tenants' volumes if storage pools are shared), and installs a rootkit to survive reboot. They may also target the Ironic conductor service to compromise other tenant nodes.

Impact Assessment

The CVSS score of 8.0 reflects the following sub-scores: a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L (as per the provided vector). Key impacts include:

• Confidentiality (High): Full read access to the bare metal node's filesystem, including any mounted tenant volumes, kernel memory, and hardware secrets.
• Integrity (High): Complete control over the host OS, allowing modification of kernel modules, bootloaders, and firmware; attacker can persist indefinitely.
• Availability (Low): The attacker may deliberately brick the node (e.g., corrupt firmware) but this is not the primary impact; the vulnerability is optimized for control, not denial-of-service.
• Blast Radius: In a typical OpenStack Ironic deployment, one compromised node can be leveraged to attack the management plane (Ironic conductor, RabbitMQ, MariaDB) if network segmentation is weak, potentially compromising all managed bare metal nodes and tenant VMs.
• Affected Systems: Any OpenStack deployment using IPA 1.0.0–11.5.0 with partition image deployment. Whole-disk image deployments are not affected, reducing the scope to environments using partition images (the historical default).

Detection Guidance

Sigma Rule

title: OpenStack Ironic-Python-Agent grub-install Chroot Escape Attempt
id: 81b3e2c4-57a4-4b1e-9c2d-7a3e0f8b4a21
status: experimental
description: Detects suspicious grub-install execution patterns on hosts running OpenStack Ironic IPA, indicating potential CVE-2026-43003 exploitation.
references:
    - https://security.openstack.org
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43003
tags:
    - attack.t1190
    - attack.privilege_escalation
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/grub-install'
            - '/grub-mkconfig'
        CommandLine|contains:
            - 'chroot'
            - '--root-directory=/tmp/'
            - '--boot-directory='
        User|contains:
            - 'ironic'
            - 'root'
    filter_known_nodepool:
        CommandLine|contains: 'nodepool'
    condition: selection and not filter_known_nodepool
level: high
falsepositives:
    - Legitimate Ironic deployments performing updates
    - Operators running grub-install manually inside chroots

YARA Rule

rule CVE_2026_43003_IPA_GroupChroot {
    meta:
        author = "Valters IT Security"
        description = "Detects known indicators of malicious partition images attempting grub-install chroot escape"
        cve = "CVE-2026-43003"
        date = "2026-01-15"
        score = 75

    strings:
        $grub_install = "/usr/sbin/grub-install" ascii fullword
        $chroot_flag = "--root-directory" ascii fullword
        $mkconfig = "grub-mkconfig" ascii fullword
        $ld_preload = "ld.so.preload" ascii
        $reverse_shell = "/bin/bash -i >& /dev/tcp/" ascii

    condition:
        filesize < 10MB and
        ($grub_install and $chroot_flag) or
        ($mkconfig and $ld_preload) or
        ($grub_install and $reverse_shell)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-43003 - OpenStack Ironic IPA Malicious Image Upload"; flow:to_server; content:"POST"; http_method; content:"/v1/nodes/"; http_uri; content:"provision"; http_uri; content:"active"; http_client_body; pcre:"/image_source[\"']?\s*[:=]\s*[\"']?[a-f0-9-]{36}/i"; sid:202643003; rev:1; reference:cve,2026-43003; reference:url,https://security.openstack.org; classtype:attempted-admin; priority:1;)

Elastic Detection

process where event.action == "exec" and
  process.name in ("grub-install", "grub-mkconfig") and
  process.args contains "--root-directory" and
  process.working_directory == "/tmp" and
  user.name in ("root", "ironic") and
  not process.parent.name in ("systemd", "ironic-conductor")

Splunk SPL Query

index=linux_secure earliest=-7d
| where process_name IN ("grub-install", "grub-mkconfig")
| where command_line LIKE "%--root-directory=%" OR command_line LIKE "%chroot%"
| where user IN ("root", "ironic")
| table _time, host, user, process_name, process_id, command_line
| search NOT command_line="*nodepool*"

Wazuh OSSEC Rule

<group name="openstack,">
    <rule id="443255" level="12">
        <decoded>process_creation</decoded>
        <match>grub-install</match>
        <regex>root-directory|chroot</regex>
        <user>root|ironic</user>
        <description>CVE-2026-43003 potential chroot escape via grub-install on IPA host</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>attack.privilege_escalation,</group>
        <info type="cve">CVE-2026-43003</info>
    </rule>
</group>

Mitigation & Patch Guidance

Immediate Mitigations (before patch is verified):

1. Disable partition image deployments on Ironic: set [deploy] allow_partition_images = false in ironic.conf until the issue is resolved. This eliminates the vulnerable code path entirely.
2. Restrict image upload privileges: Limit which tenants/projects can create custom images in Glance. Use image signing and only permit images from trusted, pre-vetted sources.
3. Network isolation: Ensure the Ironic API is not exposed to the public internet; restrict access to management network / VPN only.
4. Monitor IPA hosts: Deploy the Sigma rule above and audit all IPA executions of grub-install on a 24/7 basis.

Patch / Upgrade Steps:

1. Monitor the OpenStack security mailing list and OSV advisory 014e79df5dab0837a55a981fa23298908af14cf for the official fix.
2. When a stable release (≥ 11.5.1 or equivalent) is announced, upgrade all IPA nodes: pip install --upgrade ironic-python-agent or use the distro package manager (apt upgrade python3-ironic-python-agent).
3. After patching, re-enable partition images only after verifying that grub-install is executed with the --no-floppy flag and proper jail constraints (the expected fix).

Long-Term Hardening:

• Implement image signature verification in Glance and Ironic (via Glance verify_glance_signatures).
• Use whole-disk images exclusively where feasible; partition images are the vulnerable path.
• Adopt minimal images that contain no extra binaries in /etc/grub.d/.
• Run the IPA agent with a non-root service account where possible (though this may require upstream changes).
• Integrate IPA host audit logs with your SIEM and enable behavioral anomaly detection for process execution chains ending in grub-*.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-43003 — Official vulnerability description and CVSS vector.
2. OSV Advisory (Patch Source): https://osv.dev/vulnerability/CVE-2026-43003 — Claims patch in commit 014e79df5dab0837a55a981fa23298908af14cf; verify status before deploying.
3. OpenStack Security Advisories: https://security.openstack.org/ — Monitor for official OpenStack advisory and subsequent release notes.
4. OpenStack Ironic Documentation (Image Deployment): https://docs.openstack.org/ironic/latest/admin/deploy.html — Reference for IPA deployment workflow and configuration options (allow_partition_images).
5. CWE-250 Reference: https://cwe.mitre.org/data/definitions/250.html — "Execution with Unnecessary Privileges" category used for this flaw.

Known Threat Actor Campaigns: None reported at time of writing. EPSS score of 0.00805 (53.2% percentile) indicates low but non-trivial exploitation likelihood relative to other CVEs; the complexity of exploiting a chroot escape in a constrained environment may limit in-the-wild use until a public PoC emerges.