CVE-2026-65199 in openBMC
Summary
by MITRE • 10/13/2026
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability in openUBMC represents a critical privilege escalation flaw rooted in flawed access control logic within its SNMP management interface. Specifically, the system incorrectly assigns the full administrative privilege set to pseudo-identities associated with Simple Network Management Protocol callers. This architectural oversight allows an authenticated user who possesses only low-level privileges to execute backend operations that are reserved for high-privilege administrators. The core of this issue lies in the `route_mapper/account.lua` script, where the function responsible for determining user permissions, specifically `get_user_privilege`, is configured to return a complete nine-privilege set when it encounters users belonging to the `special_users` group. This group erroneously includes the pseudo-user designated for SNMPv1 and v2c protocols, effectively bypassing any intended restrictions on what actions these protocol handlers can perform.
From an operational perspective, this flaw enables an attacker with valid but limited credentials to gain unauthorized administrative access to the management interface. By leveraging the mapped backend operations through the SNMP service, a low-privilege user can manipulate system configurations, view sensitive data, or potentially disrupt services in ways that should be restricted by role-based access controls. The impact is severe because it undermines the principle of least privilege, allowing lateral movement and escalation without requiring additional authentication steps beyond what is already available to lower-tier users. This type of vulnerability often leads to complete compromise of the managed device, as administrative rights typically encompass control over firmware updates, network settings, and user account management.
This issue aligns with CWE-269, which describes Improper Privilege Management, specifically where a principal is assigned excessive privileges relative to its intended role. Furthermore, it relates to CWE-862, the Missing Authorization check, as the system fails to verify that the SNMP caller has sufficient rights for the requested operation before executing it. In terms of adversary tactics, this vulnerability facilitates techniques associated with MITRE ATT&CK T1078, Valid Accounts, where attackers use legitimate credentials to gain access and then escalate privileges within the environment. It also touches upon T1546, Event Triggered Execution, if the SNMP service is used as a vector for triggering malicious backend processes via crafted requests.
To mitigate this vulnerability, developers must revise the logic in `route_mapper/account.lua` to ensure that privilege assignment is strictly based on verified user roles rather than broad group memberships that include protocol-specific pseudo-users. The `special_users` group should be audited and modified so that it does not inadvertently grant administrative rights to SNMPv1_v2c identities. Additionally, implementing stricter input validation and ensuring that backend operations check for specific high-level permissions before execution is essential. Organizations relying on openUBMC should apply any available patches immediately or restrict network access to the SNMP service using firewalls to limit exposure until a permanent fix is deployed. Regular audits of role-based access control configurations are recommended to prevent similar misconfigurations in other components of the management suite.