CVE-2026-54423 Missing authorization in Ironic
An authenticated Ironic user can bypass access controls to send arbitrary IPMI commands to nodes, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54423?
CVE-2026-54423 is a high-severity missing authorization vulnerability in OpenStack Ironic, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
Weakness: CWE-424
Which versions are affected by CVE-2026-54423?
How do I fix CVE-2026-54423?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54423 being exploited?
There is no known exploitation of CVE-2026-54423 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-54423, GHSA-vxvx-hwwh-pp7c, UBUNTU-CVE-2026-54423.