CVE-2026-16141
Received Received - Intake

Authentication Bypass in OpenBMC IPMI Implementation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: runZero

Description
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-16141
EUVD
EUVD-2026-78573

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openbmc phosphor-net-ipmid *
nvidia phosphor-net-ipmid *
h3c phosphor-net-ipmid *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16141 is an authentication bypass vulnerability in OpenBMC's IPMI implementation. It allows an unauthenticated attacker to gain an authenticated IPMI session without knowing the account password by exploiting a logic error in the RAKP Message 1 handler. The flaw occurs because the handler returns early before overwriting default values, leaving the userKey set to a constant value ('0penBmc') and bmcRandomNum with stale heap contents.

Detection Guidance

To detect this vulnerability, scan for systems running OpenBMC's IPMI implementation (phosphor-net-ipmid) and check if they are exposed to the network. Use tools like nmap to identify IPMI services on port 623/TCP. Verify if the system uses a vulnerable version of phosphor-net-ipmid by checking vendor-specific firmware or logs.

Impact Analysis

An attacker can predict the bmcRandomNum value and craft a RAKP Message 3 with a matching HMAC, gaining a limited CALLBACK privilege session. This session can then be escalated to full administrative privileges through a separate vulnerability. The attacker only needs network access to the IPMI service and the name of an enabled account (e.g., root).

Mitigation Strategies

Immediately restrict network access to IPMI services (port 623/TCP) using firewalls. Disable IPMI if not required. Update to the latest fixed version of phosphor-net-ipmid as soon as patches are available. Monitor vendor advisories for NVIDIA and H3C implementations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart