What is the CVSS score of CVE-2026-54423?

CVE-2026-54423 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.5%.

Which versions of OpenStack Ironic are affected by CVE-2026-54423?

OpenStack Ironic before version 37.0.1 contains an access-control bypass in its IPMI management interface that allows authorized users to circumvent permission controls and issue arbitrary commands…. A patch is available.

How to fix or mitigate CVE-2026-54423?

24 hours: Identify all Ironic deployments and audit current authorization levels for users with IPMI deployment permissions. 7 days: Restrict send_raw deploy step access to trusted administrators only, enable comprehensive audit logging for all IPMI command execution, and document Ironic version inventory. 30 days: Implement network segregation for BMC management traffic, deploy role-based access controls limiting Ironic deployment permissions, and establish monitoring for vendor advisories targeting Ironic 37.0.1+ patch release.

OpenStack Ironic CVE-2026-54423

EUVD-2026-42781 HIGH

Improper Protection of Alternate Path (CWE-424)

2026-07-08

GHSA-vxvx-hwwh-pp7c

Authentication Bypass Red Hat

8.2

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

vuln.today AI

8.2 HIGH

Requires an authenticated deploy-capable Ironic user (PR:H) reaching the API over the network (AV:N/AC:L); the bypass crosses into the node BMC (S:C) with high availability impact from arbitrary IPMI control.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jul 10, 2026 - 05:01 EUVD

Analysis Updated

Jul 10, 2026 - 04:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 10, 2026 - 04:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 04:22 vuln.today

cvss_changed

CVSS changed

Jul 10, 2026 - 04:22 NVD

8.2 (HIGH)

Analysis Generated

Jul 08, 2026 - 17:05 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Access-control bypass in OpenStack Ironic before 37.0.1 lets an Ironic user who is authorized to deploy nodes via the IPMI management interface invoke the send_raw deploy step to issue arbitrary IPMI commands directly to a node's BMC, sidestepping the permission model Ironic normally enforces on management actions. This is an authenticated privilege-boundary flaw (CVSS 8.2, PR:H) affecting bare-metal provisioning environments; no public exploit code has been identified and it is not listed in CISA KEV at time of analysis.

Technical ContextAI

OpenStack Ironic is the bare-metal provisioning service that manages physical servers via out-of-band controllers, commonly through IPMI/BMC interfaces. Deploy steps are ordered actions Ironic executes against a node during provisioning; the raw IPMI 'send_raw' capability allows transmission of arbitrary low-level IPMI command bytes to the baseboard management controller. The root cause maps to CWE-424 (Improper Protection of Alternate Path): a functional deploy path (send_raw) reaches privileged BMC operations without applying the same access-control checks Ironic enforces on its normal management API, so a user constrained to deployment can pivot to unconstrained IPMI control. The affected component is Ironic's IPMI hardware/management interface (ipmitool driver).

RemediationAI

Vendor-released patch: upgrade OpenStack Ironic to 37.0.1 or later, which corrects the access-control enforcement on the send_raw deploy step (see OSSA-2026-025 at https://security.openstack.org/ossa/OSSA-2026-025.html and launchpad bug 2150458). Where immediate upgrade is not possible, reduce exposure by tightening RBAC/policy so that the deploy-node permission and use of raw IPMI steps are restricted to a minimal set of trusted operators, and by auditing which users/projects currently hold node-deploy rights on IPMI-managed nodes; the trade-off is reduced self-service provisioning for tenants. Additionally, segment and firewall the BMC/IPMI management network so that only the Ironic conductor can reach node BMCs, limiting blast radius, at the cost of stricter network operational overhead. Cite and follow the exact fix version 37.0.1 rather than applying ad-hoc patches.