CVE-2026-54423: OpenStack Ironic RBAC bypass in IPMI raw command execution

CVE-2026-54423 · Severity: high · CVSS 8.2 · Published 2026-07-10

OpenStack Ironic is a service used to manage and provision physical hardware (bare metal) servers. A security flaw allows users with permission to deploy or maintain servers to bypass safety controls and send raw, low-level commands directly to a server's hardware management controller (BMC). This could allow an attacker to gain persistent access to the hardware, modify network settings, or disrupt the server's availability.

Technologies: OpenStack Ironic. Vendors: OpenStack.

Quick answers

Is CVE-2026-54423 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54423 being exploited in the wild.
How severe is CVE-2026-54423?
High severity, with a CVSS score of 8.2, published 10 July 2026.
Which products and versions are affected?
OpenStack Ironic >=22.1.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1.
Is there a fix for CVE-2026-54423?
A patch was published on 2026-07-10: CVE published and fix confirmed in version 37.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54423 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54423?
Check whether you run OpenStack Ironic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in OpenStack Ironic's IPMI management interface allows users with the ability to initiate deployment, cleaning, or servicing flows to execute arbitrary IPMI commands. The 'send_raw' step, located in the ipmitool driver, was registered as a valid step for deployment and maintenance without sufficient RBAC distinction. While administrative interfaces like VendorPassthru are restricted, this flaw allows a project member with 'set_provision_state' permissions to include malicious IPMI payloads in manual cleaning or service steps. An attacker can use this to modify BMC users, alter network configurations, or ensure persistent out-of-band access. The issue is addressed in version 37.0.1 and various backported patches by implementing a blocklist for the send_raw functionality in specific provisioning methods.

Affected products

  • OpenStack Ironic >=22.1.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1

Timeline

  • 2026-04-27: disclosed: Bug reported by Metal3.io security team
  • 2026-07-08: advisory: OpenStack Security Advisory OSSA-2026-025 published
  • 2026-07-10: patched: CVE published and fix confirmed in version 37.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.