CVE-2026-54423

Published Jul 10, 2026

Last updated 2 months ago

CVSS high 8.2
Cloud

Overview

Description
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.2
Impact score
5.3
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
Severity
HIGH

Weaknesses

cve@mitre.org
CWE-424

Social media

Hype score
Not currently trending

  1. OpenStack Ironic OSSA-2026-025: RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423) https://t.co/f7TgXeAD7D OSSA-2026-026: Insufficient Access Controls regarding parent/child nodes (CVE-2026-44918) https://t.co/kuHttOJaps

    @oss_security

    9 Jul 2026

    454 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. PaperCut NG/MF Missing Authentication for Critical Function Vulnerability•CVE-2026-81578
  2. Gitea Code Injection Vulnerability•CVE-2026-60004
  3. Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.•CVE-2026-66803
  4. JetBrains TeamCity Deserialization of Untrusted Data Vulnerability•CVE-2026-63077
  5. In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.•CVE-2026-66138

References

Sources include official advisories and independent security research.