CVE-2026-8058 This Power System update is being released to address a sensitive information disclosure

Medium 4.5 Published 28 Jul 2026 Updated 28 Jul 2026

An admin user can view sensitive passwords stored in the BMC audit log when a resource dump request is made.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-8058?

CVE-2026-8058 is a medium-severity vulnerability in IBM OPENBMC, published on 28 Jul 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.

Weakness: CWE-200

Which versions are affected by CVE-2026-8058?

It affects 15 products.

Products include Ibm Power System E1050 \(9043-Mrx\) Firmware, Ibm Power System E1150 \(9043-Mru\) Firmware, Ibm Power System L1022 \(9786-22h\) Firmware, Ibm Power System L1024 \(9786-42h\) Firmware, Ibm Power System L1122 \(9856-22h\) Firmware, Ibm Power System L1124 \(9856-42h\) Firmware and 9 more.

How do I fix CVE-2026-8058?

No fix has been published for CVE-2026-8058 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-8058 being exploited?

There is no known exploitation of CVE-2026-8058 in the wild and no public exploit code.

Sources

Also known as GHSA-mm39-vmv6-rcvf.