Logic Flaw in IPMI Implementation Affecting OpenBMC and Numerous Vendors
CVE-2026-16141

8.1HIGH

Key Information:

Vendor

Openbmc

Status
Phosphor-net-ipmid
Vendor
CVE Published:
15 September 2026

What is CVE-2026-16141?

The IPMI implementation in OpenBMC's phosphor-net-ipmid exhibits a logic flaw that permits unauthenticated clients to interfere with the RAKP Message 1 handler. This flaw can lead to an improper handling of authentication processes, allowing attackers to manipulate the system. Upon sending a RAKP Message 3, the IPMI service accepts it even though its HMAC is derived from a constant 'userKey' and a potentially predictable 'bmcRandomNum'. This vulnerability could affect multiple downstream vendors that utilize this IPMI stack in their products, highlighting the importance of thorough cybersecurity protocols.

Affected Version(s)

phosphor-net-ipmid 0

References

https://www.runzero.com/advisories/openbmc-ipmi-auth-bypa...
third-party-advisory
https://www.runzero.com/blog/lights-out-exposed/
related

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HD Moore of runZero
Gadi Evron of Knostic
Tod Beardsley of runZero
.