Skip to content
fr Sign in
8.2 High

CVE-2026-54423 In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface…

Description

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Affected products and versions

Product Affected versions Fixed in
Ironic 36.0 36.0.0 → < 37.0.1 37.0.1
Ironic 32.0 32.0.0 → < 35.0.2 35.0.2
Ironic 30.0 30.0.0 → < 32.0.2 32.0.2
Ironic 22.1 22.1.0 → < 29.0.6 29.0.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Ironic

The 18 CVEs of Ironic →
CVE-2026-90458 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's… 5.4 Medium CVE-2026-89419 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to… 5.0 Medium CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of… 4.3 Medium CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is… 6.3 Medium
Track this CVE