[CVE-2026-54423] In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI ma…

Descripción técnica

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Puntuación CVSS

Score: 8.2/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

Debilidades (CWE)

CWE-424

Fuente oficial

Publicado en NIST NVD.