CVE-2026-66138 Command injection in Ironic Python Agent
A manager-role user can execute arbitrary code on Ironic Python Agent by injecting commands via the ntp_server configuration value.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66138?
CVE-2026-66138 is a high-severity command injection vulnerability in OpenStack Ironic Python Agent, published on 24 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.
Weakness: CWE-78
Which versions are affected by CVE-2026-66138?
How do I fix CVE-2026-66138?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-66138 being exploited?
There is no known exploitation of CVE-2026-66138 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-66138, GHSA-wj9f-vqw7-855c, UBUNTU-CVE-2026-66138.