A malicious user who can deploy a node through OpenStack Ironic is able to specify the IPMI send_raw deployment step with arbitrary payloads, allowing the user to send raw IPMI commands to the node's Baseboard Management Controller. This bypasses Ironic's access control and enables the attacker to issue any IPMI command supported by the BMC, which could lead to control over hardware management functions. The vulnerability is rooted in a lack of proper authorization checks for the send_raw capability (CWE-862) and an insufficiently restricted interface that permits arbitrary command input (CWE-424). The likely attack vector is the send_raw IPMI step invoked by a user with deployment privileges.

The vulnerability applies to OpenStack Ironic, affecting any deployment that uses the send_raw step in the deployment, cleaning, or servicing workflows. Versions prior to 37.0.1 are vulnerable, and any release exposing the send_raw interface remains potentially vulnerable until a patch is issued.

The CVSS v3 score of 8.2 classifies the issue as high, highlighting the potential for significant impact on the BMC. Exploitation would require the attacker to have authorization to invoke deployment, cleaning, or servicing steps—roles typically reserved for system administrators. Because the EPSS score is < 1% and the vulnerability is not yet listed in CISA's KEV catalog, the current likelihood of exploitation remains uncertain, but the presence of a privileged attack vector warrants careful mitigation. Based on the description, it is inferred that the attacker must have administrative-level permissions to trigger the vulnerable step. Once an update is released, applying the patch is the most effective countermeasure; until then, limiting users who can trigger these flows and configuring Ironic to reject arbitrary raw IPMI commands are prudent interim steps.