CVE-2026-54423

—

CVSS 3.1

8.2 high

EPSS

<1%p23

Published

Jul 10, 2026 (Jul 10, 2026)

Modified

Jul 10, 2026

Description

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Weakness: CWE-424
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.