OpenBMC vulnerabilities
We track 4 vulnerabilities in OpenBMC products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest OpenBMC vulnerabilities
- 8.1 High severity
phosphor-net-ipmid: Use of Uninitialized Variable
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RA
- 8.8 High severity
phosphor-net-ipmid: Incorrect Authorization
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream
- 9.8 Critical severity
slpd-lite: Buffer Copy without Checking Size of Input
slpd-lite is a unicast SLP UDP server. Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building OpenBMC. Nefarious users can send slp packets to the BMC using UDP port 427 to cause memory overflow
- 7.5 High severity
OpenBMC: Out-of-bounds Read
Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access.