This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-54423 →

DEBIAN-CVE-2026-54423

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_ra...

Original description

The description as published by the source.

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ironic

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 ironic

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.0.5-0+deb13u3"}]}]

Debian:14 ironic

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:35.0.1-8"}]}]

References

advisory security-tracker.debian.org