What is GHSA-vxvx-hwwh-pp7c?

GHSA-vxvx-hwwh-pp7c is a security advisory published by GitHub Security Advisories with High severity. In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI...

Which CVE IDs does GHSA-vxvx-hwwh-pp7c cover?

GHSA-vxvx-hwwh-pp7c covers the following CVE IDs: CVE-2026-54423. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vxvx-hwwh-pp7c?

GHSA-vxvx-hwwh-pp7c has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

GHSA-vxvx-hwwh-pp7cHighCVSS 8.2

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI...

Vendor

GitHub Security Advisories

Published

July 10, 2026

Last Modified

July 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-54423 →

📋 Description

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-54423
https://bugs.launchpad.net/ironic/+bug/2150458
https://security.openstack.org/ossa/OSSA-2026-025.html
https://github.com/advisories/GHSA-vxvx-hwwh-pp7c