CVE-2026-54423: OpenStack Ironic Auth Bypass Vulnerability

CVE-2026-54423 Overview

CVE-2026-54423 affects OpenStack Ironic versions prior to 37.0.1. An authenticated Ironic user with permission to deploy nodes using the Intelligent Platform Management Interface (IPMI) management driver can abuse the send_raw deployment step to issue arbitrary IPMI commands to a managed node. This bypasses the access control layer that Ironic normally enforces on IPMI operations.

The flaw is categorized under [CWE-424] (Improper Protection of Alternate Path). Exploitation allows a tenant-level operator to interact directly with the baseboard management controller (BMC) of a bare-metal node, potentially altering firmware settings, power state, or boot configuration.

Critical Impact
Authenticated users can send unrestricted IPMI commands to bare-metal nodes, bypassing Ironic access controls and gaining low-level hardware control over managed servers.

Affected Products

OpenStack Ironic versions prior to 37.0.1
OpenStack deployments using the IPMI management interface
Bare-metal nodes provisioned through vulnerable Ironic releases

Discovery Timeline

2026-07-10 - CVE-2026-54423 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-54423

Vulnerability Analysis

OpenStack Ironic manages bare-metal machines and exposes an IPMI driver to control node power, boot media, and hardware settings. Ironic normally mediates IPMI operations through its own API, applying role-based access control and validating requested actions.

The vulnerability resides in the send_raw deployment step exposed by the IPMI driver. A user authorized to deploy nodes can inject this step into a deployment workflow and pass arbitrary IPMI raw command bytes. Ironic forwards those bytes to the BMC without applying the same access control checks that gate its standard IPMI API endpoints.

Because raw IPMI commands operate directly on the BMC, the attacker gains a control channel that is not visible to Ironic's authorization layer. This effectively creates an alternate code path around the protection Ironic applies to sanctioned IPMI operations.

Root Cause

The root cause is a missing authorization check on the send_raw step within the IPMI management interface. Ironic treats the step as a deployment operation rather than as a privileged IPMI command, so the standard policy enforcement that governs direct IPMI API calls does not apply to raw commands issued through this path.

Attack Vector

An attacker must hold an authenticated Ironic account with permission to deploy nodes using the IPMI driver. The attacker crafts a deployment or cleaning workflow that includes the send_raw step with attacker-chosen IPMI command bytes. When Ironic executes the step, the raw command is transmitted to the target node's BMC over the network.

Successful exploitation can force power cycles, change boot devices, reset BMC credentials, or modify hardware inventory in ways that persist across tenant reassignment. See the OpenStack Security Advisory OSSA-2026-025 and the Launchpad Bug Report for technical details.

Detection Methods for CVE-2026-54423

Indicators of Compromise

Deployment or cleaning steps invoking send_raw on the IPMI management interface for nodes that do not normally require raw commands.
Unexpected IPMI traffic from Ironic conductor hosts to BMC management networks outside of standard provisioning windows.
BMC audit logs showing configuration changes (boot device, user accounts, SEL clearing) that do not correspond to authorized Ironic workflows.

Detection Strategies

Audit Ironic API logs for POST requests that include send_raw in the steps payload and correlate them with the requesting user and target node.
Compare executed deployment steps against an allow-list of approved cleaning and deployment templates for each project.
Enable BMC-side logging and forward System Event Log (SEL) entries to a central log store for correlation with Ironic activity.

Monitoring Recommendations

Alert on any use of send_raw outside of documented maintenance runbooks.
Monitor for privilege changes on BMC accounts and unexpected chassis bootdev or user-management IPMI commands.
Track deployments initiated by non-administrative Ironic users that reference custom step definitions.

How to Mitigate CVE-2026-54423

Immediate Actions Required

Upgrade OpenStack Ironic to version 37.0.1 or later where the authorization check on send_raw is enforced.
Review Ironic role assignments and remove IPMI deployment privileges from users who do not require them.
Rotate BMC credentials on nodes that were reachable by users with deployment access during the exposure window.

Patch Information

OpenStack fixed the issue in Ironic 37.0.1. The patch enforces access control on the send_raw step so that it cannot be used to bypass Ironic's IPMI policy layer. Refer to the OpenStack Security Advisory OSSA-2026-025 and the Openwall OSS-Security Discussion for release details.

Workarounds

Restrict the Ironic policy file to prevent non-administrative roles from submitting custom deployment steps that include send_raw.
Segment the BMC management network so that only the Ironic conductor can reach IPMI interfaces, limiting lateral abuse.
Disable the IPMI driver on deployments that can use a more restricted management interface such as Redfish with scoped credentials.

bash

# Upgrade Ironic to the patched release using pip in the conductor virtualenv
pip install --upgrade 'ironic>=37.0.1'

# Restart the Ironic services after upgrading
systemctl restart openstack-ironic-api
systemctl restart openstack-ironic-conductor