# cve.now: Openstack

The newest entries naming Openstack as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115642](https://cve.now/CVE-2026-115642.md): In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an… (CVSS 8.3)
- [CVE-2026-90458](https://cve.now/CVE-2026-90458.md): OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor\_passthru, e.g., to delete accounts from the BMC's Redfish service. (CVSS 5.4)
- [CVE-2026-89419](https://cve.now/CVE-2026-89419.md): OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in… (CVSS 5.0)
- [CVE-2026-115638](https://cve.now/CVE-2026-115638.md): OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a (CVSS 4.3)
- [CVE-2026-93856](https://cve.now/CVE-2026-93856.md): In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. (CVSS 4.3)
- [CVE-2026-71195](https://cve.now/CVE-2026-71195.md): In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. (CVSS 9.9)
- [CVE-2026-97147](https://cve.now/CVE-2026-97147.md): In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projec (CVSS 7.2)
- [CVE-2026-93861](https://cve.now/CVE-2026-93861.md): In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workf (CVSS 6.0)
- [CVE-2026-93860](https://cve.now/CVE-2026-93860.md): In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directl (CVSS 7.1)
- [CVE-2026-93858](https://cve.now/CVE-2026-93858.md): In OpenStack Mistral through 23.0.0, the std.ssh\_proxied action passes a caller-supplied proxy\_command value directly to paramiko.ProxyComma (CVSS 8.7)
- [CVE-2026-107363](https://cve.now/CVE-2026-107363.md): In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent (CVSS 6.1)
- [CVE-2026-97404](https://cve.now/CVE-2026-97404.md): In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. (CVSS 9.2)
- [CVE-2026-97149](https://cve.now/CVE-2026-97149.md): In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. (CVSS 5.3)
- [CVE-2026-94572](https://cve.now/CVE-2026-94572.md): In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls\_ciphers field for control charact (CVSS 9.4)
- [CVE-2026-94571](https://cve.now/CVE-2026-94571.md): In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect\_url and redirect (CVSS 9.4)
- [CVE-2026-93854](https://cve.now/CVE-2026-93854.md): In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2 (CVSS 7.2)
- [CVE-2026-93852](https://cve.now/CVE-2026-93852.md): In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projec (CVSS 7.1)
- [CVE-2026-71198](https://cve.now/CVE-2026-71198.md): In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. (CVSS 7.0)
- [CVE-2026-90461](https://cve.now/CVE-2026-90461.md): OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) B (CVSS 6.3)
- [CVE-2026-90460](https://cve.now/CVE-2026-90460.md): An issue was discovered in OpenStack Keystone before 29.0.3. (CVSS 7.6)
- [CVE-2026-80183](https://cve.now/CVE-2026-80183.md): In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment (CVSS 7.1)
- [CVE-2026-80184](https://cve.now/CVE-2026-80184.md): In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, (CVSS 7.6)
- [CVE-2026-80182](https://cve.now/CVE-2026-80182.md): In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could c (CVSS 7.6)
- [CVE-2026-77648](https://cve.now/CVE-2026-77648.md): In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import\_filtering\_opts, allowing an admin to fetc (CVSS 2.2)
- [CVE-2026-76878](https://cve.now/CVE-2026-76878.md): In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all\_projects query parameter is set to false. (CVSS 8.4)
- [CVE-2026-74250](https://cve.now/CVE-2026-74250.md): In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing t (CVSS 6.3)
- [CVE-2026-74248](https://cve.now/CVE-2026-74248.md): OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. (CVSS 4.3)
- [CVE-2026-71194](https://cve.now/CVE-2026-71194.md): In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. (CVSS 6.8)
- [CVE-2026-71193](https://cve.now/CVE-2026-71193.md): In OpenStack Designate before 22.0.1, zone creation checks (\_is\_subzone, \_is\_superzone, and the duplicate-zone DB constraint) are scoped to (CVSS 9.6)
- [CVE-2026-71201](https://cve.now/CVE-2026-71201.md): In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or (CVSS 5.0)
- [CVE-2026-71192](https://cve.now/CVE-2026-71192.md): In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) fr (CVSS 6.0)
- [CVE-2026-71191](https://cve.now/CVE-2026-71191.md): In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-\* headers are covered by the SigV4 signature on pre (CVSS 6.0)
- [CVE-2026-71190](https://cve.now/CVE-2026-71190.md): In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracki (CVSS 8.7)
- [CVE-2026-55707](https://cve.now/CVE-2026-55707.md): In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. (CVSS 7.1)
- [CVE-2026-66139](https://cve.now/CVE-2026-66139.md): OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. (CVSS 4.8)
- [CVE-2026-66138](https://cve.now/CVE-2026-66138.md): In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a runni (CVSS 7.2)
- [CVE-2026-54422](https://cve.now/CVE-2026-54422.md): In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extrac (CVSS 5.5)
- [CVE-2026-54423](https://cve.now/CVE-2026-54423.md): In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use t (CVSS 8.2)
- [CVE-2026-44918](https://cve.now/CVE-2026-44918.md): OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. (CVSS 5.5)
- [CVE-2026-50221](https://cve.now/CVE-2026-50221.md): In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Hos (CVSS 5.3)
- [CVE-2026-55748](https://cve.now/CVE-2026-55748.md): OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metachara (CVSS 6.0)
- [CVE-2026-46448](https://cve.now/CVE-2026-46448.md): In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. (CVSS 5.4)
- [CVE-2026-54421](https://cve.now/CVE-2026-54421.md): In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return (CVSS 6.8)
- [CVE-2026-50589](https://cve.now/CVE-2026-50589.md): In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or J (CVSS 5.3)
- [CVE-2026-50266](https://cve.now/CVE-2026-50266.md): In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set devic (CVSS 2.2)
- [CVE-2026-48681](https://cve.now/CVE-2026-48681.md): OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. (CVSS 5.9)
- [CVE-2026-44917](https://cve.now/CVE-2026-44917.md): OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a p (CVSS 4.9)
- [CVE-2026-41283](https://cve.now/CVE-2026-41283.md): OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. (CVSS 9.9)
- [CVE-2026-46447](https://cve.now/CVE-2026-46447.md): OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver\_info or node.instance\_info (CVSS 5.8)
- [CVE-2026-49299](https://cve.now/CVE-2026-49299.md): In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defi (CVSS 5.3)
- [CVE-2026-44394](https://cve.now/CVE-2026-44394.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0)
- [CVE-2026-43000](https://cve.now/CVE-2026-43000.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0)
- [CVE-2026-42999](https://cve.now/CVE-2026-42999.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0)
- [CVE-2026-42998](https://cve.now/CVE-2026-42998.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0)
- [CVE-2026-49017](https://cve.now/CVE-2026-49017.md): In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bo (CVSS 7.1)
- [CVE-2026-44919](https://cve.now/CVE-2026-44919.md): In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:/// (CVSS 4.3)
- [CVE-2026-44916](https://cve.now/CVE-2026-44916.md): In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance\_info\['ks\_template'\] is rendered without sandboxing. (CVSS 3.0)
- [CVE-2026-40214](https://cve.now/CVE-2026-40214.md): In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. (CVSS 6.3)
- [CVE-2026-40213](https://cve.now/CVE-2026-40213.md): OpenStack Cyborg before 16.0.1 uses rule:allow (check\_str='@') as the default policy for multiple API endpoints. (CVSS 7.4)
- [CVE-2026-43002](https://cve.now/CVE-2026-43002.md): An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. (CVSS 5.3)
- [CVE-2026-42997](https://cve.now/CVE-2026-42997.md): An issue was discovered in idrac in OpenStack Ironic before 35.0.1. (CVSS 7.7)
- [CVE-2026-43003](https://cve.now/CVE-2026-43003.md): An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. (CVSS 8.0)
- [CVE-2026-43001](https://cve.now/CVE-2026-43001.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 7.9)
- [CVE-2026-42510](https://cve.now/CVE-2026-42510.md): OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface. (CVSS 6.6)
- [CVE-2026-40683](https://cve.now/CVE-2026-40683.md): In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user\_enable (CVSS 7.7)
- [CVE-2026-40212](https://cve.now/CVE-2026-40212.md): OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wr (CVSS 5.4)
- [CVE-2026-33551](https://cve.now/CVE-2026-33551.md): An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. (CVSS 3.5)
- [CVE-2026-34881](https://cve.now/CVE-2026-34881.md): OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). (CVSS 5.0)
- [CVE-2026-28370](https://cve.now/CVE-2026-28370.md): In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger cod (CVSS 9.1)
- [CVE-2026-24708](https://cve.now/CVE-2026-24708.md): An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. (CVSS 8.2)
- [CVE-2026-22797](https://cve.now/CVE-2026-22797.md): An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.1 (CVSS 9.9)
- [CVE-2025-65073](https://cve.now/CVE-2025-65073.md): OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Ke (CVSS 7.5)
- [CVE-2025-44021](https://cve.now/CVE-2025-44021.md): OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the (CVSS 2.8)
- [CVE-2022-38065](https://cve.now/CVE-2022-38065.md): A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. (CVSS 8.8)
- [CVE-2022-38060](https://cve.now/CVE-2022-38060.md): A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. (CVSS 8.8)
- [CVE-2013-2255](https://cve.now/CVE-2013-2255.md): HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side (no CVSS)
- [CVE-2017-12155](https://cve.now/CVE-2017-12155.md): A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openstack
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.