Openstack vulnerabilities
77 CVEs and advisories name Openstack as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115642In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an…
- CVE-2026-90458OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
- CVE-2026-89419OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in…
- CVE-2026-115638OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a
- CVE-2026-93856In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API.
- CVE-2026-71195In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.
- CVE-2026-97147In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projec
- CVE-2026-93861In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workf
- CVE-2026-93860In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directl
- CVE-2026-93858In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyComma
- CVE-2026-107363In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent
- CVE-2026-97404In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.
- CVE-2026-97149In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests.
- CVE-2026-94572In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control charact
- CVE-2026-94571In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect
- CVE-2026-93854In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2
- CVE-2026-93852In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projec
- CVE-2026-71198In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image.
- CVE-2026-90461OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) B
- CVE-2026-90460An issue was discovered in OpenStack Keystone before 29.0.3.
- CVE-2026-80183In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment
- CVE-2026-80184In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials,
- CVE-2026-80182In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could c
- CVE-2026-77648In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetc
- CVE-2026-76878In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false.
- CVE-2026-74250In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing t
- CVE-2026-74248OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization.
- CVE-2026-71194In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests.
- CVE-2026-71193In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to
- CVE-2026-71201In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or