CVE-2026-16141: OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely exposed?
Systems using phosphor-net-ipmid as their IPMI stack are affected by the described flaw. The data identifies downstream implementations from NVIDIA and H3C as examples, but does not provide affected product models or versions.
What does an attacker need to exploit this issue?
An attacker needs network access to the IPMI service and does not need credentials or user interaction. Exploitation depends on triggering the RAKP Message 1 handling path that leaves the default userKey in place and then submitting a RAKP Message 3 with an HMAC based on that key and the BMC random value.
Is a default configuration relevant to exploitation?
Yes. The bypass relies on the authentication object's constructor-default 20-byte userKey derived from the string "0penBmc" not being overwritten. It also relies on the BMC random value being predictable often enough to compute the required HMAC.