{"id":"CVE-2026-65210","kind":"vulnerability","aliases":["CVE-2026-65210"],"related":[],"title":"BMC firmware: authenticated IPMI administrator can read arbitrary files","description":"This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.","summary":"An authenticated IPMI administrator can read arbitrary files from the BMC (baseboard management controller) filesystem. This discloses material beyond what the IPMI management role should reach.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","infrastructure","ipmi","self-hosted","servers"],"not_affected_if":["no-bmc","no-ipmi"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T08:16:54+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:36+00:00","updated_at":"2026-10-27T08:32:36+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-27T08:32:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BMC firmware: authenticated IPMI administrator can read arbitrary files","impact":"medium","summary":"An authenticated IPMI administrator can read arbitrary files from the BMC (baseboard management controller) filesystem. This discloses material beyond what the IPMI management role should reach.","category":"infrastructure","nicknames":[],"who_cares":["bmc","ipmi","servers","self-hosted"],"confidence":0.4,"needs_auth":"yes","worst_case":"IPMI admin reads arbitrary BMC files, including secrets","analyst_note":"Find the vendor and affected BMC firmware versions and the patched release from the NVD entry and vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ipmi","no-bmc"],"who_is_affected":"Teams that run servers with a BMC exposing IPMI to administrators. The sources do not name the vendor, the affected firmware versions, or whether IPMI must be enabled for exposure. Systems without IPMI or BMC access can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000539,"input_tokens":3278,"output_tokens":422,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-65210':12A,15A 'administr':5A,26B,56C 'allow':52C 'arbitrari':8A,29B,59C 'authent':3A,24B,54C 'baseboard':34B 'beyond':41B,68C 'bmc':1A,16B,33B,63C 'control':36B 'cve':10A,13A 'disclos':39B,65C 'file':9A,30B,60C 'filesystem':37B,64C 'firmwar':2A 'host':21B 'infrastructur':17B 'intend':70C 'ipmi':4A,18B,25B,44B,55C,71C 'issu':50C 'manag':35B,45B,72C 'materi':40B,66C 'may':51C 'reach':48B 'read':7A,28B,58C 'role':46B,73C 'self':20B 'self-host':19B 'server':22B 'well':67C","nicknames":[],"mitigations":[],"who_affected":"Teams that run servers with a BMC exposing IPMI to administrators. The sources do not name the vendor, the affected firmware versions, or whether IPMI must be enabled for exposure. Systems without IPMI or BMC access can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65210","severity":null,"published_at":"2026-10-27T08:16:54+00:00","modified_at":"2026-10-27T08:16:54+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}