CVE-2026-16141 OpenBMC CVE debrief

Who should care

Defenders responsible for IPMI configurations, particularly those using OpenBMC or downstream vendors like NVIDIA and H3C, should assess exposure and implement mitigations. This includes verifying if the IPMI stack is implemented in their environment, reviewing compensating controls, and monitoring IPMI activity. Additionally, security teams and operators should review and update IPMI configurations to ensure secure authentication and consider the priority

Why it matters

CVE-2026-16141 is a logic flaw in OpenBMC's IPMI implementation, phosphor-net-ipmid, allowing unauthenticated authentication bypass. Defenders should verify exposure, implement compensating controls, and monitor IPMI activity.

• Potential authentication bypass in IPMI implementations
• Increased risk of unauthorized access to IPMI interfaces
• Need for verification of affected vendors and versions
• Priority on implementing compensating controls and monitoring IPMI activity

Technical summary

The phosphor-net-ipmid implementation in OpenBMC contains a logic flaw allowing unauthenticated clients to force the RAKP Message 1 handler to return before overwriting authentication object constructor defaults. This can lead to accepting a RAKP Message 3 with a predictable HMAC, computed using a constant 20-byte 'userKey' and an often-predictable 'bmcRandomNum'. The vulnerability affects downstream vendors such as NVIDIA and H3C, who implement this IPMI stack. Defenders should prioritize verifying exposure and implementing compensating controls due to potential authentication bypass.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls due to potential authentication bypass.

Recommended defensive actions

• Verify exposure by checking if the IPMI stack is implemented in your environment
• Implement compensating controls to mitigate potential authentication bypass
• Monitor for suspicious IPMI activity
• Review and update IPMI configurations to ensure secure authentication
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the logic flaw in phosphor-net-ipmid. However, the scope of affected vendors and versions requires further verification. The vulnerability's impact on downstream vendors like NVIDIA and H3C needs assessment. Defenders should verify exposure by checking if the IPMI stack is implemented in their environment and review compensating controls to mitigate potential authentication bypass.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.