VulnSocial

CVE-2026-54423Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-424

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-09: 1Technical Details · 2026-07-09: 107-09
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Open Source Security mailing list@oss_security
    Disclosure

    OpenStack Ironic OSSA-2026-025: RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423) https://www.openwall.com/lists/oss-security/2026/07/08/3 OSSA-2026-026: Insufficient Access Controls regarding parent/child nodes (CVE-2026-44918) https://www.openwall.com/lists/oss-security/2026/07/08/4

    Post summary

    OpenStack Ironic advisories OSAA‑2026‑025 and OSAA‑2026‑026 disclose RBAC bypass in IPMI raw command execution and insufficient access controls for parent/child nodes, but provide no PoC, exploitation evidence, or patch details.

    00010559
    4.6K followersView on X

Explore more

Back to dashboard