OpenStack Ironic: send_raw step lets a deploy-capable user issue arbitrary IPMI commands to a node

CVSS 8.2CVE-2026-54423Firmware, BMC & network fabriccurated

Impact

A user who is only authorized to deploy nodes can use the IPMI send_raw step to push arbitrary raw IPMI commands at the BMC of a node, bypassing the access control Ironic normally places in front of out-of-band management. On a bare-metal GPU fleet provisioned by Ironic that means a tenant with deploy rights reaches the management controller directly: power control, boot device changes, SOL, BMC user and network settings, depending on what the BMC accepts. The BMC sits below the operating system, so actions taken there survive a reimage and are not visible to anything running on the node. Fixed in Ironic 37.0.1.

Who can reach it

Authenticated Ironic user (or project) holding permission to deploy nodes using the IPMI management interface; no access to the management VLAN itself is needed, since Ironic conductors reach the BMCs on the user's behalf.

What to do

Upgrade Ironic to 37.0.1 or later and restart the ironic-api and ironic-conductor services; this is a control-plane service restart, nodes do not need to be drained or rebooted. Until then, restrict who holds node deploy permissions and review BMC configuration and BMC credentials on nodes that untrusted projects have deployed, since BMC-level changes persist across reprovisioning.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-54423 https://security.openstack.org/ossa/OSSA-2026-025.html https://bugs.launchpad.net/ironic/+bug/2150458

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.