UBUNTU-CVE-2026-54423
OpenStack Ironic versions before 37.0.1 contain a vulnerability where an Ironic user with deployment permissions on IPMI-managed nodes can exploit the send_raw step to issue arbitrary IPMI commands, bypassing access controls. This allows unauthorized command execution on managed nodes. The vulnerability affects multiple Ubuntu package versions of Ironic. No known exploits are reported in the wild.
AI Analysis
Technical Summary
This vulnerability in OpenStack Ironic prior to version 37.0.1 allows an authenticated user with the ability to deploy nodes using the IPMI management interface to bypass Ironic's access control by leveraging the send_raw step to send arbitrary IPMI commands to a node. This flaw could lead to unauthorized control over node management operations. The issue is present in numerous Ubuntu-specific Ironic package versions across several LTS and interim releases. There is no vendor advisory or patch link provided in the data, so patch status is not confirmed here.
Potential Impact
An attacker with deployment privileges on IPMI-managed nodes can execute arbitrary IPMI commands, potentially leading to unauthorized information disclosure, integrity violations, and high availability impact on the affected nodes. This could compromise node management and control within the OpenStack environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict deployment permissions to trusted users only and monitor for unusual IPMI command activity where possible.
UBUNTU-CVE-2026-54423
Description
OpenStack Ironic versions before 37.0.1 contain a vulnerability where an Ironic user with deployment permissions on IPMI-managed nodes can exploit the send_raw step to issue arbitrary IPMI commands, bypassing access controls. This allows unauthorized command execution on managed nodes. The vulnerability affects multiple Ubuntu package versions of Ironic. No known exploits are reported in the wild.
CVSS v3.1
Score 8.2high
Affected software
pkg:deb/ubuntu/ironic@1:5.1.2-0ubuntu1?arch=source&distro=xenialpkg:deb/ubuntu/ironic@1:10.1.1-0ubuntu2?arch=source&distro=bionicpkg:deb/ubuntu/ironic@1:15.0.0-0ubuntu0.20.04.1?arch=source&distro=focalpkg:deb/ubuntu/ironic@1:20.1.0-0ubuntu1.3?arch=source&distro=jammypkg:deb/ubuntu/ironic@1:24.1.1-0ubuntu1.3?arch=source&distro=noblepkg:deb/ubuntu/ironic@1:32.0.0-0ubuntu1.1?arch=source&distro=questingpkg:deb/ubuntu/ironic@1:35.0.0-0ubuntu2.1?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in OpenStack Ironic prior to version 37.0.1 allows an authenticated user with the ability to deploy nodes using the IPMI management interface to bypass Ironic's access control by leveraging the send_raw step to send arbitrary IPMI commands to a node. This flaw could lead to unauthorized control over node management operations. The issue is present in numerous Ubuntu-specific Ironic package versions across several LTS and interim releases. There is no vendor advisory or patch link provided in the data, so patch status is not confirmed here.
Potential Impact
An attacker with deployment privileges on IPMI-managed nodes can execute arbitrary IPMI commands, potentially leading to unauthorized information disclosure, integrity violations, and high availability impact on the affected nodes. This could compromise node management and control within the OpenStack environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict deployment permissions to trusted users only and monitor for unusual IPMI command activity where possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-54423
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b47c68715ace43d9e9df
Added to database: 07/16/2026, 10:37:48 UTC
Last enriched: 07/16/2026, 11:54:30 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.