CVE-2026-81936 · Infrastructure
NO FIX YET · SEE WHAT TO DO
In Lenovo ThinkSystem v4 XClarity Controller 3 firmware versions 2.51 through 2.56, a regression brings back the default OpenBMC root password after a Reset to Default. An attacker who knows that default can log in to enabled administrative interfaces and reach the underlying XCC operating system.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Lenovo ThinkSystem v4 servers with XClarity Controller 3 firmware between 2.51 (IHX432Y) and 2.56 (IHX436K). Exposure appears after a Reset to Default, which re-applies the default OpenBMC root password; servers on other firmware or with changed credentials are not described as affected.
Not affected if changed-default-credentials, other-firmware-versions
Who cares bmc, lenovo, servers, thinksystem, xclarity-controller
2.51 (IHX432Y) through 2.56 (IHX436K) are affected2.56 (affected builds are no longer available for download; the sources do not name the fixed version)An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.