CVE-2026-54423 OpenStack CVE debrief

Who should care

OpenStack Ironic users and administrators should assess and mitigate this IPMI command injection vulnerability. They should review access controls for Ironic users and nodes, and implement compensating controls to monitor and restrict IPMI access. Additionally, they should inventory OpenStack Ironic deployments for potential exposure and apply the vendor-provided patch or upgrade to version 37.0.1 or later.

Technical summary

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control. This issue has a CVSS score of 8.2 and is classified as HIGH severity. The vulnerability allows for arbitrary IPMI command injection, potentially leading to unauthorized access and control of nodes.

Defensive priority

High priority for OpenStack Ironic users and administrators to assess and mitigate this vulnerability.

Recommended defensive actions

• Inventory OpenStack Ironic deployments for potential exposure
• Assess and apply the vendor-provided patch or upgrade to version 37.0.1 or later
• Implement compensating controls to monitor and restrict IPMI access
• Review and update access controls for Ironic users and nodes
• Verify IPMI management interface configurations for secure access
• Monitor for suspicious IPMI activity and implement logging and alerting
• Conduct regular security audits and vulnerability assessments for OpenStack Ironic deployments

Evidence notes

The CVE record and NVD entry provide details on this vulnerability. Additional information can be found in the OpenStack security advisory and Launchpad bug report. OpenStack Ironic users should verify their deployments for potential exposure and review access controls for Ironic users and nodes. The IPMI management interface allows arbitrary IPMI commands to be sent to a node, bypassing Ironic's access control. This issue has a CVSS score of 8.2 and is classified as HIGH severity. Users should assess and apply the vendor-provided patch or upgrade to version 37.0.1 or later.

Official resources