CVE-2026-8058

Analyzed Analyzed - Analysis Complete

IBM OPENBMC Password Exposure in Resource Dump Log

Publication date: 2026-07-28

Last updated on: 2026-08-26

Assigner: IBM Corporation

Description

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-08-26

Generated

2026-09-07

AI Q&A

2026-07-28

EPSS Evaluated

2026-09-05

NVD

CVE-2026-8058

EUVD

EUVD-2026-49885

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	power_system_s1122_(9824-22a)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_s1124_(9824-42a)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_s1122s_(9824-22b)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_s1114_(9824-41b)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_l1122_(9856-22h)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_l1124_(9856-42h)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_e1150_(9043-mru)_firmware	From fw1110.00 (inc) to fw1110.30 (exc)
ibm	power_system_s1022_(9105-22a)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_s1024_(9105-42a)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_s1022s_(9105-22b)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_s1014_(9105-41b)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_l1022_(9786-22h)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_l1024_(9786-42h)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_e1050_(9043-mrx)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)
ibm	power_system_s1012_(9028-21b)_firmware	From fw1060.00 (inc) to fw1060.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability allows a user to provide a password during a resource dump request in IBM OPENBMC firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71. The password is then stored in the BMC audit log, where an administrator can view it, exposing sensitive information to unauthorized individuals.

Detection Guidance

Check BMC audit logs for entries containing passwords supplied during resource dump requests. Review firmware versions to confirm if they fall within affected ranges (FW1110.00-FW1110.20 or FW1060.00-FW1060.71).

Commands: 1) Use ipmitool to query BMC logs: 'ipmitool sel list'. 2) Check firmware version: 'ipmitool fru print' or 'bmc info' depending on system.

Impact Analysis

The exposure of passwords in audit logs could lead to unauthorized access to systems or data if an attacker gains administrative access to the BMC logs. This may result in data breaches, system compromise, or further lateral movement within a network.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing sensitive data like passwords in audit logs. Unauthorized access to such data may lead to regulatory penalties due to non-compliance with data protection and security standards.

Mitigation Strategies

Update firmware to recommended versions: FW1110.30(1110_145) or newer for Power 11 systems, and 1060.72(1060_177), 1060.80(1060_185), or newer for Power 10 systems.

Restrict access to BMC administrative functions and review audit logs for unauthorized activity.

Hi! I’m here to help you understand CVE-2026-8058. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70