CVE-2026-54423: OpenStack Ironic IPMI Privilege Escalation (v37.0.1)

Technical summary

CVE-2026-54423 stems from insufficient input validation in Ironic's IPMI send_raw step. The vulnerability exists in the Ironic management layer before version 37.0.1. An authenticated user with node deployment privileges can invoke the send_raw command to transmit unfiltered IPMI commands to target nodes. Because Ironic does not properly validate or restrict the command payload, attackers bypass the framework's access control mechanisms and interact directly with the BMC (Baseboard Management Controller), potentially executing high-privileged operations intended to be restricted. The flaw is classified as CWE-424 (Unrestricted Upload of File with Dangerous Type), reflecting the risk of sending dangerous commands without proper filtering.

Business impact

This vulnerability poses a significant risk to organizations operating OpenStack Ironic for bare-metal cloud deployments. A malicious or compromised operator account can leverage the flaw to perform unauthorized hardware management tasks—rebooting nodes, modifying BIOS settings, extracting sensitive data, or disrupting service availability. In multi-tenant or managed service environments, this represents a lateral privilege escalation vector that can compromise the integrity and availability of the entire bare-metal fleet. Incident response and forensics are complicated by the direct BMC access, which may bypass logging and auditing controls.

Affected systems

OpenStack Ironic deployments running version 37.0.0 and earlier are vulnerable. The flaw is specific to the IPMI management interface; other management drivers (Redfish, iLO, etc.) are not affected by this particular vulnerability. Organizations using Ironic in production for bare-metal provisioning and lifecycle management should prioritize inventory and assessment.

Exploitability

Exploitation requires valid Ironic credentials with node deployment permissions—a moderate barrier to entry. The attack vector is network-based (AV:N) and requires no user interaction. However, it is not a zero-click vulnerability; it demands an authenticated user with existing privileges. The CVSS 3.1 score of 8.2 (HIGH) reflects high impact on availability and integrity, along with low confidentiality risk. The wide scope (S:C) indicates the vulnerability can affect other systems beyond the node being managed. The overall exploitability is elevated for insider threat scenarios or if credentials are compromised.

Remediation

Upgrade OpenStack Ironic to version 37.0.1 or later. This version includes fixes to validate and restrict IPMI commands sent via the send_raw step, restoring proper access control enforcement. Organizations unable to upgrade immediately should restrict IPMI management interface usage and audit access logs for any send_raw command invocations.

Patch guidance

Verify and deploy OpenStack Ironic 37.0.1 or higher across all affected deployments. Patch testing should include validation that legitimate IPMI operations (e.g., power management, sensor reads) continue to function while dangerous command classes are blocked. Review any custom automation or workflows that may depend on send_raw functionality and adjust them to comply with the new restrictions. Consider staging patches in a pre-production environment to confirm compatibility with your specific hardware and configuration.

Detection guidance

Monitor Ironic logs for send_raw step invocations, particularly those targeting production nodes. Audit successful IPMI command execution against the BMC. Examine system audit logs on nodes for unexpected BIOS or hardware-level changes initiated via IPMI. Implement alerting on any send_raw activity from non-administrative accounts. Review role-based access control (RBAC) configurations to ensure deployment permissions are scoped narrowly to intended users.

Why prioritize this

Although not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits high priority due to its HIGH CVSS score, the need for valid credentials to exploit it, and the potential for significant operational impact in multi-tenant environments. Organizations with high-value bare-metal infrastructure or strict compliance requirements should treat this as a priority patch. The 10-day window between disclosure and patch availability is typical and should be treated as an urgent remediation window.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: (1) network accessibility (AV:N) allowing remote exploitation; (2) low attack complexity (AC:L) requiring standard credentials; (3) high privilege requirement (PR:H) limiting the attack surface; (4) no user interaction (UI:N); (5) wide scope (S:C) indicating impact beyond the target node; and (6) combined low confidentiality, low integrity, and high availability impact. The score appropriately captures the privileged insider or credential-compromise risk while acknowledging the authentication barrier.

Frequently asked questions