CVE-2026-8058
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow a user to supply a password with a resource dump request, which is then stored in the BMC audit log where an admin user can see it.
Risk Assessment
Exposure of the password in the audit log could allow an administrator to gain unauthorized access to resources the password was intended for, increasing the risk of confidentiality breach.
Recommendation
Update IBM OpenBMC to a version that does not store passwords in the audit log, or apply a workaround by manually clearing the logs.
Other vulnerabilities in IBM OpenBMC
See all- CVE-2026-18849Medium
IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access can execute arbitrary code under specific conditions, impacting confidentiality, integrity, and availability.
- CVE-2026-7868Medium
IBM OpenBMC versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 allow ReadOnly users to escalate privileges and give themselves administrator privileges.
Original NVD description (English source)
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.