Skip to content
Fencer Intel
high 8.2

CVE-2026-54423 json

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use…

published 4mo ago modified 17d ago also EUVD-2026-42781

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Patch / fix

  • OpenStack Ironic 29.0.6, 32.0.2, 35.0.2, 37.0.1
  • ironic Debian 13 1:29.0.5-0+deb13u3
  • ironic Debian 14 1:35.0.1-8

debian advisories DEBIAN-CVE-2026-54423

Is CVE-2026-54423 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-54423 updated cvss 6.5

openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step

  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ironic-rhel9 1788267862
    fixed: vendor fix RHSA-2026:62410
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-rhel9 1789369044
    fixed: vendor fix RHSA-2026:67858
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-ironic-rhel9 1788262679
    fixed: vendor fix RHSA-2026:62550
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-ironic-rhel9 1789937634
    fixed: vendor fix RHSA-2026:70587
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-ironic-rhel9 1788575555
    fixed: vendor fix RHSA-2026:65852
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-ironic-rhel9 1788310589
    fixed: vendor fix RHSA-2026:63047
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-ironic-rhel9 1787735443
    fixed: vendor fix RHSA-2026:60446
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-ironic-rhel9 1787555702
    fixed: vendor fix RHSA-2026:60477
show 2 more
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-ironic-rhel9 1787676828
    fixed: vendor fix RHSA-2026:60441
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1788216408, openshift4/ose-pod 1788219871, openshift4/ose-tests 1788220580, openshift4/ose-console 1788218669, openshift4/ose-coredns 1788219858, openshift4/ose-deployer 1788220243, +191 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1789102997, openshift4/ose-tests 1789376918, openshift4/ose-console 1789369299, openshift4/ose-deployer 1789107290, openshift4/ose-installer 1789113259, openshift4/ose-pod-rhel9 1789372584, +184 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1788207694, openshift4/ose-pod-rhel9 1788163832, openshift4/ose-sdn-rhel9 1788161204, openshift4/ose-etcd-rhel9 1788161700, openshift4/ose-tests-rhel9 1788158409, openshift4/ose-tools-rhel9 1788154930, +184 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1789938330, openshift4/ose-cli-rhel9 1789937904, openshift4/ose-pod-rhel9 1789937463, openshift4/ose-etcd-rhel9 1789937632, openshift4/ose-tests-rhel9 1790075131, openshift4/ose-tools-rhel9 1790073665, +180 more Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1788576352, openshift4/ose-cli-rhel9 1788576309, openshift4/ose-pod-rhel9 1788575535, openshift4/ose-etcd-rhel9 1788576053, openshift4/ose-tests-rhel9 1788579480, openshift4/ose-tools-rhel9 1788576163, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1788311982, openshift4/ose-cli-rhel9 1788311429, openshift4/ose-pod-rhel9 1788311898, openshift4/ose-etcd-rhel9 1788318849, openshift4/ose-tests-rhel9 1788340321, openshift4/ose-tools-rhel9 1788338367, +180 more
    +6 more products
    Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1787736001, openshift4/ose-cli-rhel9 1787735982, openshift4/ose-pod-rhel9 1787736197, openshift4/ose-etcd-rhel9 1787736773, openshift4/ose-tests-rhel9 1787737933, openshift4/ose-tools-rhel9 1787736243, +184 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1787555870, openshift4/ose-cli-rhel9 1787556246, openshift4/ose-pod-rhel9 1787558631, openshift4/ose-etcd-rhel9 1787562282, openshift4/ose-tests-rhel9 1787563149, openshift4/ose-tools-rhel9 1787557205, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1787570998, openshift4/ose-cli-rhel9 1787572868, openshift4/ose-pod-rhel9 1787573725, openshift4/ose-etcd-rhel9 1787573317, openshift4/ose-tests-rhel9 1787743885, openshift4/ose-tools-rhel9 1787722489, +182 more Red Hat OpenStack Platform 16.2 openstack-ironic, openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor Red Hat OpenStack Platform 17.1 openstack-ironic, openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor Red Hat OpenStack Platform 18.0 openstack-ironic
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

Affected products

  • OpenStack Ironic

Classification

Weakness
  • CWE-424 Improper Protection of Alternate Path

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.