CVE-2026-71568

Published: Sep 17, 2026Modified: Sep 18, 2026

5.3

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.6 / Impact: 3.6

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be (Secondary)

Description

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://github.com/openshift-metal3/bmctest/security/advisories/GHSA-53vv-qh77-2hqh

Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be

Timeline

No history available yet.