Aller au contenu
en Se connecter
8.2 Élevée

CVE-2026-54423 In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface…

Description

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Produits et versions touchés

Produit Versions touchées Corrigé en
Ironic 36.0 36.0.0 → < 37.0.1 37.0.1
Ironic 32.0 32.0.0 → < 35.0.2 35.0.2
Ironic 30.0 30.0.0 → < 32.0.2 32.0.2
Ironic 22.1 22.1.0 → < 29.0.6 29.0.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Ironic

Les 18 CVE de Ironic →
CVE-2026-90458 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's… 5.4 Moyenne CVE-2026-89419 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to… 5.0 Moyenne CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of… 4.3 Moyenne CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is… 6.3 Moyenne
Suivre cette CVE