# CVE-2026-8058: IBM OpenBMC sensitive information disclosure in audit logs

Source: https://junglewise.ai/threats/cve-2026-8058-ibm-openbmc-sensitive-information-disclosure-in-audit-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-8058 · Severity: medium · CVSS 4.5 · Published 2026-07-28

IBM Power Systems using OpenBMC firmware are affected by a security flaw where user passwords may be recorded in plain text within system audit logs. This occurs when a user includes a password as part of a diagnostic 'resource dump' request. An administrative user with access to these logs could view these passwords, potentially leading to unauthorized access or further compromise of the system.

Technologies: [IBM OPENBMC FW1110](https://junglewise.ai/threats/technologies/openbmc-fw1110). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-8058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8058 being exploited in the wild.

**How severe is CVE-2026-8058?** Medium severity, with a CVSS score of 4.5, published 28 July 2026.

**Which products and versions are affected?** IBM OpenBMC FW1060 FW1060.00 through FW1060.71; IBM OPENBMC FW1110 FW1110.00 through FW1110.20.

**Is there a fix for CVE-2026-8058?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8058 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-8058?** Check whether you run IBM OpenBMC FW1060 or IBM OPENBMC FW1110 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A sensitive information disclosure vulnerability (CWE-200) exists in the diagnostic interface of IBM OpenBMC firmware. When a user initiates a resource dump request and includes a password, the firmware incorrectly logs the full request, including the password, into the BMC audit log. An attacker with administrative privileges (PR:H) could read these logs to recover user credentials. The vulnerability affects Power 10 and Power 11 systems. Remediation is available in firmware versions FW1110.30 (1110_145), 1060.72 (1060_177), and 1060.80 (1060_185) or newer.

## Affected products

- IBM OPENBMC FW1110 FW1110.00 through FW1110.20
- IBM OPENBMC FW1060 FW1060.00 through FW1060.71

## Timeline

- 2026-07-21: disclosed: Initial publication by IBM
- 2026-07-28: advisory: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7280642](https://www.ibm.com/support/pages/node/7280642)

## Related threats

- [IBM OpenBMC privilege escalation in HTTPS interface](https://junglewise.ai/threats/cve-2026-7868-ibm-openbmc-privilege-escalation-in-https-interface)
- [IBM OPENBMC denial of service in HTTPS interface](https://junglewise.ai/threats/cve-2026-7254-ibm-openbmc-denial-of-service-in-https-interface)