CVE-2026-16141

HighCVSS 8.1

Published: 15/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. An unauthenticated client can force the RAKP Message 1 handler to return early before overwriting the authentication object's defaults. The IPMI service then accepts a RAKP Message 3 with HMAC computed using a constant 20-byte 'userKey' initialized from '0penBmc' and an often-predictable 'bmcRandomNum'.

Risk Assessment

The vulnerability allows remote authentication bypass and access to the BMC, potentially leading to full server compromise.

Recommendation

Update phosphor-net-ipmid to a patched version and restrict IPMI access to trusted networks.

Other vulnerabilities in phosphor-net-ipmid

CVE-2026-16140High
Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. A logic flaw allows replacing the authorization context of an existing session with a target account while maintaining the original integrity and encryption keys, leading to privilege escalation without re-authentication.

Original NVD description (English source)

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS