CVE-2026-16140 in phosphor-net-ipmid
Summary
by MITRE • 09/15/2026
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C. This issue effectively allows for privilege escalation without re-authentication.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in OpenBMC's phosphor-net-ipmid implementation represents a critical logic flaw within the Intelligent Platform Management Interface protocol handling mechanisms. Specifically, the defect lies in how session authorization contexts are managed during IPMI operations. When an existing authenticated session is utilized for subsequent requests, the system fails to properly validate or isolate the user context associated with that session. Instead of maintaining the strict association between the active cryptographic keys and the original authenticating account, the implementation allows this relationship to be overwritten by a target account identifier while preserving the integrity and encryption parameters established during the initial authentication phase. This architectural oversight creates a significant security gap where the system trusts the structural validity of the IPMI message envelope without verifying that the payload's intended recipient or actor aligns with the session's actual permissions.
This flaw effectively enables privilege escalation without re-authentication, allowing an attacker who has obtained valid credentials for a lower-privileged account to manipulate internal state variables to assume higher privileges. By exploiting this logic error, an adversary can execute commands typically reserved for administrators, such as modifying firmware settings, accessing sensitive system logs, or altering hardware configurations, all while appearing to operate under the guise of their original authorized session. The persistence of the original integrity and encryption keys means that standard security controls relying on message authentication codes do not detect this anomaly, as the cryptographic signatures remain valid relative to the established session parameters rather than the escalated context. This bypasses multi-factor or role-based access control expectations inherent in secure BMC designs.
The operational impact is severe given the widespread adoption of phosphor-net-ipmid by major hardware vendors including NVIDIA and H3C. These implementations serve as the primary interface for out-of-band management, which often possesses root-level access to underlying operating systems and hardware components. An attacker leveraging this vulnerability could gain persistent control over critical infrastructure, potentially leading to data exfiltration, service disruption, or further lateral movement within a networked environment. The ability to escalate privileges without triggering additional authentication prompts makes detection difficult through standard logging mechanisms that primarily track successful login events rather than internal session state manipulations.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-345 Insufficient Verification of Data Authenticity within the context of protocol sessions. In terms of offensive security frameworks, it maps to ATT&CK technique T1078 Valid Accounts, specifically involving the misuse of legitimate credentials to bypass access controls through session manipulation rather than credential theft or brute force. Mitigation strategies must focus on patching the phosphor-net-ipmid component in OpenBMC distributions and ensuring that downstream vendors apply corresponding updates. Administrators should enforce strict network segmentation for BMC interfaces, restrict IPMI access to trusted management networks only, and monitor for anomalous privilege changes within system logs. Additionally, implementing session binding mechanisms that tightly couple cryptographic keys with specific user contexts at every request validation step can prevent the context replacement flaw from being exploited in future iterations of the software.