IPMI Arbitrary Command Execution in OpenStack Ironic

Executive Summary

CVE-2026-54423 is a role-based access control (RBAC) bypass vulnerability in OpenStack Ironic that affects the IPMI (Intelligent Platform Management Interface) raw command execution.

Specifically, a user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

This flaw arises because the send_raw function in the ipmitool.py module is registered as a clean, service, and deploy step without distinct permission checks, allowing users with provisioning permissions to execute arbitrary IPMI raw bytes.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows an attacker with provisioning permissions to send arbitrary IPMI commands to a node's Baseboard Management Controller (BMC).

This can lead to unauthorized modifications of BMC settings, user management, and network configurations, potentially granting persistent and unauthorized access to targeted nodes.

The impact includes a high severity risk to system integrity and availability, as attackers could disrupt or control hardware management functions at the BMC level.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-54423, operators should apply patches that blocklist the IPMI send_raw functionality in certain provisioning methods to prevent unauthorized execution of arbitrary IPMI commands.

The fix involves restricting the send_raw step through policy enforcement or a step blocklist, ensuring only system administrators can execute it.

Operators should review the patch changes carefully to avoid disruptions in existing workflows.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a user with node deployment permissions to bypass role-based access control and send arbitrary IPMI commands to a node's Baseboard Management Controller (BMC). This can lead to unauthorized modifications and persistent access at the hardware management level.

Such unauthorized access and control over hardware management interfaces could potentially lead to breaches of data integrity and availability, which are critical aspects of compliance with standards like GDPR and HIPAA.

However, the provided resources do not explicitly discuss the direct impact of this vulnerability on compliance with specific regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0