IBM OpenBMC Credential Exposure Vulnerability CVE-2026-8058 Security Advisory

Vulnerability Overview CVE ID: CVE-2026-8058 Description: OPENBMC allows users to supply a password via a resource dump request, which is then stored in the BMC audit log and visible to administrator users. CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS Base Score: 4.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Affected Products Affected Products: - OPENBMC FW1110.00 - FW1110.20 - OPENBMC FW1060.00 - FW1060.71 Specific Product Models: - Power 11: - IBM Power System S1222 (9824-22A) - IBM Power System S1224 (9824-42A) - IBM Power System S1222z (9824-22B) - IBM Power System S1114 (9824-41B) - IBM Power System L1222 (9856-22H) - IBM Power System L1224 (9856-42H) - IBM Power System E1150 (9043-MRU) - Power 10: - IBM Power System S1022 (9105-22A) - IBM Power System S1024 (9105-42A) - IBM Power System S1022z (9105-22B) - IBM Power System S1014 (9105-41B) - IBM Power System L1022 (9786-22H) - IBM Power System L1024 (9786-42H) - IBM Power System E1050 (9043-MRX) - IBM Power System S1012 (9028-21B) Remediation Power 11: Install FW1110.30(1110_145) or a later version. Power 10: Install 1060.72(1060_177), 1060.80(1060_185), or a later version. Additional Information Workaround Mitigations: Protect access to BMC administrative functions. References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer The Common Vulnerability Scoring System (CVSS), according to the Forum of Incident Response and Security Teams (FIRST), is an "industry open standard" designed to communicate vulnerability severity and assist in determining response urgency and prioritization. IBM provides CVSS scores "as is" without any warranties, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM periodically updates component records in its product portfolio to address potential vulnerabilities. As part of this effort, IBM identifies vulnerabilities in the product/service list that were previously unidentified, regardless of the CVE date. The inclusion of an earlier CVE ID does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability prior to that date. IBM is committed to informing customers of relevant vulnerabilities as it becomes aware of them. The "Affected Products and Versions" section of IBM security bulletins is intended to list only IBM-supported products and versions that are not end-of-support or out of warranty. Therefore, the reference of unsupported or extended support products and versions in this security bulletin does not constitute an IBM determination that these products are unaffected by the vulnerability. Referencing one or more unsupported versions in this security bulletin does not impose any remediation obligation on IBM for unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM OpenBMC Credential Exposure Vulnerability CVE-2026-8058 Security Advisory