CVE-2026-8058
Awaiting Analysis Awaiting Analysis - Queue

IBM OPENBMC Password Exposure in Resource Dump Log

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-8058
EUVD
EUVD-2026-49885

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm openbmc From fw1110.00 (inc) to fw1110.20 (inc)
ibm openbmc From fw1060.00 (inc) to fw1060.71 (inc)
ibm openbmc From 1110.00 (inc) to 1110.20 (inc)
ibm openbmc From 1060.00 (inc) to 1060.71 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a user to provide a password during a resource dump request in IBM OPENBMC firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71. The password is then stored in the BMC audit log, where an administrator can view it, exposing sensitive information to unauthorized individuals.

Detection Guidance

Check BMC audit logs for entries containing passwords supplied during resource dump requests. Review firmware versions to confirm if they fall within affected ranges (FW1110.00-FW1110.20 or FW1060.00-FW1060.71).

Commands: 1) Use ipmitool to query BMC logs: 'ipmitool sel list'. 2) Check firmware version: 'ipmitool fru print' or 'bmc info' depending on system.

Impact Analysis

The exposure of passwords in audit logs could lead to unauthorized access to systems or data if an attacker gains administrative access to the BMC logs. This may result in data breaches, system compromise, or further lateral movement within a network.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing sensitive data like passwords in audit logs. Unauthorized access to such data may lead to regulatory penalties due to non-compliance with data protection and security standards.

Mitigation Strategies

Update firmware to recommended versions: FW1110.30(1110_145) or newer for Power 11 systems, and 1060.72(1060_177), 1060.80(1060_185), or newer for Power 10 systems.

Restrict access to BMC administrative functions and review audit logs for unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart