CVE-2026-16140: OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C. This issue effectively allows for privilege escalation without re-authentication.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs network access to the IPMI service and valid low-privileged IPMI credentials or an existing low-privileged session. No user interaction is required.
What is the impact after successful exploitation?
An attacker can replace the session authorization context with that of a target account while retaining the original session's integrity and encryption keys. This enables privilege escalation without authenticating as the target account and can lead to high-impact compromise of confidentiality, integrity, and availability.
Which environments should be prioritized for investigation?
Prioritize systems using OpenBMC phosphor-net-ipmid for IPMI, including downstream implementations identified as using this stack, such as NVIDIA and H3C. Systems with IPMI reachable over the network and accounts with lower privileges are particularly relevant.