CVE-2026-65199 Details
Description
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
A vulnerability in openUBMC allows low-privilege SNMP users to execute backend operations as administrative users. This issue arises because the system grants full privileges to pseudo-identities representing SNMP callers. In the file 'route_mapper/account.lua', the function 'get_user_privilege' assigns all nine privileges to the 'special_users' group, which includes the 'SNMPv1_v2c' pseudo-user.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026CNA
Assessed Jan 1, 1References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.runzero.com/advisories/huawei-openUBMC-snmp-privsec-cve-2026-65199 | runZero | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | runZero |
Affected Products
| Product | Versions |
|---|---|
| Huawei openUBMC | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | runZero |