OpenStack Ironic RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423)

[OSSA-2026-025] RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423) Vulnerability Overview Vulnerability ID: CVE-2026-54423 Affected Versions: OpenStack Ironic Severity: Critical Status: In Progress Description: In Ironic, the step is intentionally exposed for operator use. However, there is no distinction in permissions between "provisioning the node" and "sending arbitrary IPMI commands." Impact Scope Affected Component: OpenStack Ironic Affected Users: Any user capable of invoking the provisioning step can send arbitrary IPMI raw bytes. Attack Vector: Verification: Project members possess permissions. These permissions are included in manual/cleaning steps. Impact: Verification: Arbitrary IPMI commands can modify BMC users, network settings, and achieve persistent access. Remediation Feasibility: Feasible. Add a separate policy or restrict it to admin-only steps. Side Effects: Users relying on project-level command access will need to update their policies. Recommendation: The researchers' recommendation is reasonable. Specific Fixes: - Add logic to to verify the user request context when task execution is asynchronous. - Add additional logic for clean/service steps to verify steps within the scheduler worker. - Add default policy rules to block . Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links: - Discussion Link - Discussion Link Related Patches Patch Links: - 0001-WIP-Extend-the-RBAC-policy-matrix-to-steps.patch - 0001-security-block-vendor-send_raw.patch - 0001-security-block-vendor-send_raw.patch Related CVEs CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution CVE-2026-54423: RBAC Bypass in IPMI Raw Command Execution Related Discussions Discussion Links

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Ironic RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423)

More from this source