CVE-2026-16140

Name of the Vulnerable Software and Affected Versions phosphor-net-ipmid (affected versions not specified)

Description A logic flaw in the IPMI implementation of OpenBMC allows the authorization context of an active session to be replaced with a target account. This occurs while the original integrity and encryption keys remain active, enabling privilege escalation without the need for re-authentication. This implementation is used by several downstream vendors, including NVIDIA and H3C.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.