Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-54423
8.2 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): High (H)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): High (H)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
In OpenStack Ironic before 37.0.1, an Ironic user with the …
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
References
Affected products
Ironic
- <29.0.6
- <37.0.1
- <35.0.2
- <32.0.2
Matching in nixpkgs
pkgs.ironicclient
Client for OpenStack bare metal provisioning API, includes a Python module (ironicclient) and CLI (baremetal)
pkgs.python313Packages.python-ironicclient
Client for OpenStack bare metal provisioning API, includes a Python module (ironicclient) and CLI (baremetal)
Package maintainers
-
@anthonyroussel Anthony Roussel <anthony@roussel.dev>
-
@vinetos vinetos <contact+git@vinetos.fr>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>