PT-2026-57058 · Openstack · Ironic

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-54423

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Fix

Weakness Enumeration

CWE-424

Related Identifiers

CVE-2026-54423

Affected Products

Ironic

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-54423 · Security Note
• https://security.openstack.org/ossa/OSSA-2026-025.html · Note
• https://bugs.launchpad.net/ironic/+bug/2150458 · Note