EUVD-2026-81609Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Adjacent-only transient exposure with a required race gives AV:A and AC:H; no auth (PR:N) but impact is integrity-dominant control of Ironic, so C:N/A:N/I:H.
Primary rating from Vendor (redhat-cnalr).
CVSS VectorVendor: redhat-cnalr
Lifecycle Timeline
2DescriptionCVE.org
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
AnalysisAI
BMCtest's test harness starts an Ironic bare-metal provisioning service without authentication or TLS, letting an attacker on the adjacent network modify node and provisioning state through the unauthenticated Ironic API for as long as the test is running. Exploitation is heavily constrained by a timing race: the unprotected Ironic instance exists only during an active bmctest run, and the attacker must reach the API before the harness tears it down, which is why the CVSS vector carries AC:H and the overall score is only 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, integrity-only impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be actively executing a bmctest run, during which Ironic is deliberately started without authentication or TLS; the exposure exists ONLY for that test duration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite the CWE-306 'missing authentication' framing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched version is identified in the available data (the only reference is the GitHub advisory GHSA-53vv-qh77-2hqh at https://github.com/openshift-metal3/bmctest/security/advisories/GHSA-53vv-qh77-2hqh, which should be consulted for current fix status and any tagged release). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today