CVE-2026-71568

MEDIUMCVSS 5.3

Description

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.

Timeline

Published:September 17th, 2026 2:17 PM

Last modified:September 18th, 2026 7:06 PM

CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-306

References & Reports

Advisories, patches, and third-party reports

https://github.com/openshift-metal3/bmctest/security/advisories/GHSA-53vv-qh77-2hqh

Source: NIST NVD · Data may lag official sources by up to one minute