CVE-2026-54423

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-10 · updated 2026-10-25
Weakness: CWE-424

Description

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Affected products

OpenStack Ironic: from 22.1.0 before 29.0.6; from 30.0.0 before 32.0.2; from 32.0.0 before 35.0.2; from 36.0.0 before 37.0.1 — fixed in 29.0.6, 32.0.2, 35.0.2, 37.0.1

How to fix

Upgrade to a fixed version: OpenStack Ironic 29.0.6, 32.0.2, 35.0.2, 37.0.1. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/ironic/+bug/2150458
https://security.openstack.org/ossa/OSSA-2026-025.html
http://www.openwall.com/lists/oss-security/2026/07/08/3

Get alerted when CVE-2026-54423 or the next vulnerability affects your stack