CVE-2026-8058: IBM OpenBMC Information Disclosure Flaw

CVE-2026-8058 Overview

CVE-2026-8058 affects IBM OpenBMC firmware, where the Baseboard Management Controller (BMC) improperly stores user-supplied passwords in the audit log during resource dump requests. When a user submits a password alongside a resource dump request, the firmware writes that password into the BMC audit log in a form visible to administrative users. The flaw is categorized as an information exposure issue [CWE-200] and impacts multiple firmware release trains.

Critical Impact
An administrator with access to the BMC audit log can retrieve plaintext passwords supplied by other users, enabling credential reuse and lateral movement across managed systems.

Affected Products

IBM OpenBMC FW1110.00 through FW1110.20
IBM OpenBMC FW1060.00 through FW1060.71
Systems relying on the affected OpenBMC firmware for management operations

Discovery Timeline

2026-07-28 - CVE-2026-8058 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-8058

Vulnerability Analysis

The vulnerability resides in the resource dump request handler within IBM OpenBMC firmware. Resource dump operations accept a password parameter from the requesting user as part of the request payload. Instead of redacting or discarding this sensitive input after processing, the firmware writes the raw password value into the BMC audit log.

Audit logs on the BMC are readable by administrative accounts. This means any admin-level user with legitimate log access can view passwords that other users supplied during resource dump operations. The information exposure classification [CWE-200] applies because sensitive authentication material crosses a trust boundary it should not cross.

The issue does not permit code execution or data modification. However, harvested credentials may be reused against other services if users share passwords across systems.

Root Cause

The root cause is missing input sanitization in the audit logging pipeline of the resource dump feature. The handler treats the password field as ordinary request metadata and serializes it into the persistent log. A correct implementation would either omit the field from the log entirely or replace it with a fixed redaction marker before writing.

Attack Vector

Exploitation requires two conditions. First, a legitimate user must submit a resource dump request that includes a password. Second, an admin-privileged user must access the BMC audit log to read the stored value. The attack is network-reachable through the BMC management interface but requires high privileges to retrieve the exposed data, limiting practical exploitation to insiders or attackers who have already compromised an administrative account.

No public proof-of-concept code is available. See the IBM Support Page for vendor-supplied technical details.

Detection Methods for CVE-2026-8058

Indicators of Compromise

Audit log entries associated with resource dump operations that contain unexpected string fields resembling user passwords
Repeated administrator reads of the BMC audit log outside of scheduled review windows
Access to the BMC management interface from unexpected source addresses followed by audit log retrieval

Detection Strategies

Parse BMC audit log entries for resource dump events and flag records that contain fields matching password patterns or high-entropy strings
Correlate resource dump submissions with subsequent audit log exports by administrative accounts
Compare firmware version banners against the vulnerable ranges FW1110.00–FW1110.20 and FW1060.00–FW1060.71

Monitoring Recommendations

Forward BMC audit logs to a centralized SIEM or data lake for retention and pattern-based analysis
Alert on any administrator account performing bulk audit log downloads from OpenBMC endpoints
Track authentication events on services where passwords supplied to the BMC could be reused, watching for credential replay

How to Mitigate CVE-2026-8058

Immediate Actions Required

Inventory all systems running IBM OpenBMC and identify instances within the affected firmware ranges
Restrict BMC audit log access to a minimal set of administrative accounts and require multi-factor authentication for those accounts
Rotate any passwords that users may have supplied to resource dump requests on affected firmware versions
Review historical audit logs and purge or redact entries containing exposed password material

Patch Information

IBM has published guidance and remediation details on the IBM Support Page. Administrators should apply the firmware updates published by IBM for the affected FW1110 and FW1060 release trains as soon as change windows permit.

Workarounds

Avoid supplying passwords in resource dump requests on vulnerable firmware until patches are applied
Limit administrative access to the BMC audit log through role-based access control and network segmentation of the management plane
Isolate BMC management interfaces on a dedicated out-of-band network reachable only from trusted administrative jump hosts

bash

# Verify installed OpenBMC firmware version and compare against affected ranges
curl -k -u <admin>:<password> \
  https://<bmc-host>/redfish/v1/UpdateService/FirmwareInventory/bmc_active \
  | jq '.Version'

# Affected ranges:
#   FW1110.00 - FW1110.20
#   FW1060.00 - FW1060.71