p PatchFirst

CVE-2026-54423

CVE-2026-54423

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

CVSS 8.2 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ironic

    Versions
    • ≥ 22.1.0, < 29.0.6: Affected (semver)
    • ≥ 30.0.0, < 32.0.2: Affected (semver)
    • ≥ 32.0.0, < 35.0.2: Affected (semver)
    • ≥ 36.0.0, < 37.0.1: Affected (semver)

    Update to 29.0.6; Update to 32.0.2; Update to 37.0.1

  • ironic Debian:12

    Versions
    • 1:21.1.0-3
    • 1:21.1.0-3+deb12u1
    • 1:21.3.0-1
    • 1:21.4.0-1
    • 1:21.4.0-2
    • 1:21.4.0-3
    • 1:21.4.0-4
    • 1:21.4.4-0+deb12u1
    • 1:21.4.4-0+deb12u2
    • 1:22.1.0-1
    • 1:23.0.0-1
    • 1:23.0.0-2
    • 1:23.0.0-3
    • 1:23.0.0-4
    • 1:24.0.0-1
    • 1:24.1.0-1
    • 1:24.1.1-1
    • 1:24.1.1-2
    • 1:24.1.1-3
    • 1:26.0.0-1
    • 1:26.0.0-2
    • 1:26.1.0-1
    • 1:26.1.0-2
    • 1:26.1.0-3
    • 1:26.1.1-1
    • 1:26.1.1-2
    • 1:26.1.1-3
    • 1:26.1.1-4
    • 1:29.0.0-1
    • 1:29.0.0-2
    • 1:29.0.0-3
    • 1:29.0.0-4
    • 1:29.0.0-5
    • 1:29.0.0-6
    • 1:29.0.0-7
    • 1:32.0.0-1
    • 1:32.0.0-2
    • 1:32.0.0-4
    • 1:32.0.0-5
    • 1:32.0.0-6
    • 1:32.0.0-7
    • 1:34.0.0-1
    • 1:35.0.0-1
    • 1:35.0.0-2
    • 1:35.0.1-1
    • 1:35.0.1-10
    • 1:35.0.1-2
    • 1:35.0.1-3
    • 1:35.0.1-5
    • 1:35.0.1-6
    • 1:35.0.1-7
    • 1:35.0.1-8
    • 1:35.0.1-9
    • 1:38.0.0-1
    • 1:38.0.0-2
    • 1:38.0.0-3
    • 1:39.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Debian:13

    Versions
    • 1:29.0.0-7
    • 1:29.0.5-0+deb13u1
    • 1:29.0.5-0+deb13u2
    Affected ranges
    • ECOSYSTEM: < 1:29.0.5-0+deb13u3

    Update to 1:29.0.5-0+deb13u3

  • ironic Debian:14

    Versions
    • 1:29.0.0-7
    • 1:32.0.0-1
    • 1:32.0.0-2
    • 1:32.0.0-4
    • 1:32.0.0-5
    • 1:32.0.0-6
    • 1:32.0.0-7
    • 1:34.0.0-1
    • 1:35.0.0-1
    • 1:35.0.0-2
    • 1:35.0.1-1
    • 1:35.0.1-2
    • 1:35.0.1-3
    • 1:35.0.1-5
    • 1:35.0.1-6
    • 1:35.0.1-7
    Affected ranges
    • ECOSYSTEM: < 1:35.0.1-8

    Update to 1:35.0.1-8

  • ironic Ubuntu:16.04:LTS

    Versions
    • 1:4.2.0-0ubuntu1
    • 1:4.3.0-0ubuntu1
    • 1:5.1.0-0ubuntu1
    • 1:5.1.2-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:18.04:LTS

    Versions
    • 1:9.1.0-0ubuntu2
    • 1:9.2.0-0ubuntu1
    • 1:10.0.0-0ubuntu1
    • 1:10.1.0-0ubuntu1
    • 1:10.1.1-0ubuntu1
    • 1:10.1.1-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:20.04:LTS

    Versions
    • 1:13.0.1-0ubuntu1
    • 1:14.0.0~b1~git2019121713.76597ca93-0ubuntu1
    • 1:14.0.0~b1~git2019121713.76597ca93-0ubuntu2
    • 1:14.0.0-0ubuntu1
    • 1:14.0.1~git2020032415.de2d907fc-0ubuntu1
    • 1:14.0.1~git2020041013.af9e6ba90-0ubuntu2
    • 1:15.0.0-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:22.04:LTS

    Versions
    • 1:18.2.0-0ubuntu1
    • 1:18.2.0+git2021120910.cdc3b9538-0ubuntu1
    • 1:19.0.0+git2022011216.7beadee46-0ubuntu1
    • 1:20.0.0+git2022030313.4e6a3d52e-0ubuntu1
    • 1:20.1.0-0ubuntu1
    • 1:20.1.0-0ubuntu1.1
    • 1:20.1.0-0ubuntu1.2
    • 1:20.1.0-0ubuntu1.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:24.04:LTS

    Versions
    • 1:23.0.0-0ubuntu3
    • 1:23.1.0+git2024011916.a374a0c1-0ubuntu1
    • 1:24.1.0-0ubuntu1
    • 1:24.1.1-0ubuntu1
    • 1:24.1.1-0ubuntu1.2
    • 1:24.1.1-0ubuntu1.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:25.10

    Versions
    • 1:29.0.0-0ubuntu1
    • 1:30.0.0+git2025070713.577833d78-0ubuntu1
    • 1:30.0.0+git2025070713.577833d78-0ubuntu2
    • 1:32.0.0-0ubuntu1
    • 1:32.0.0-0ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:26.10

    Versions
    • 1:35.0.0-0ubuntu2
    • 1:35.0.0-0ubuntu3
    • 1:38.0.0+git20260818.101.f8e78b0-0ubuntu1
    • 1:38.0.0+git2026091517.26c022f13-0ubuntu1
    • 1:39.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ironic Ubuntu:26.04:LTS

    Versions
    • 1:32.0.0-0ubuntu1
    • 1:34.0.0-0ubuntu1
    • 1:35.0.0-0ubuntu1
    • 1:35.0.0-0ubuntu2
    • 1:35.0.0-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →