What is CVE-2026-54423?

CVE-2026-54423 is a high-severity vulnerability in Openstack Ironic, classified under CWE-424. CVSS score: 8.2/10. Published 2026-07-10.

How severe is CVE-2026-54423?

High severity. CVSS v3 base score is 8.2 out of 10.

Vulnerability in Openstack Ironic

CVE-2026-54423

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H.

Affected products

Openstack Ironic — versions 22.1.0, 30.0.0, 32.0.0

Weakness classification (CWE)

CWE-424

References

cve@mitre.org
cve@mitre.org
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-54423?: CVE-2026-54423 is a high-severity vulnerability in Openstack Ironic, classified under CWE-424. CVSS score: 8.2/10. Published 2026-07-10.
How severe is CVE-2026-54423?: High severity. CVSS v3 base score is 8.2 out of 10.