What is GHSA-wj9f-vqw7-855c?

GHSA-wj9f-vqw7-855c is a security advisory published by GitHub Security Advisories with High severity. In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can...

Which CVE IDs does GHSA-wj9f-vqw7-855c cover?

GHSA-wj9f-vqw7-855c covers the following CVE IDs: CVE-2026-66138. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wj9f-vqw7-855c?

GHSA-wj9f-vqw7-855c has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-wj9f-vqw7-855cHighCVSS 7.2

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can...

Vendor

GitHub Security Advisories

Published

July 24, 2026

Last Modified

July 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-66138 →

📋 Description

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-66138
https://bugs.launchpad.net/ironic-python-agent/+bug/2160050
https://security.openstack.org/ossa/OSSA-2026-027.html
https://github.com/advisories/GHSA-wj9f-vqw7-855c