CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
Unauthenticated attackers can bypass IPMI authentication in OpenBMC by exploiting a race condition and hardcoded default keys, gaining privileged access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16141?
CVE-2026-16141 is a high-severity authentication bypass vulnerability in OpenBMC phosphor-net-ipmid, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.
Which versions are affected by CVE-2026-16141?
How do I fix CVE-2026-16141?
No fix has been published for CVE-2026-16141 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-16141 being exploited?
There is no known exploitation of CVE-2026-16141 in the wild and no public exploit code.
Sources
Also known as GHSA-28w7-pg33-g2hj.