Openstack vulnerabilities
77 CVEs and advisories name Openstack as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-71192In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) fr
- CVE-2026-71191In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on pre
- CVE-2026-71190In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracki
- CVE-2026-55707In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets.
- CVE-2026-66139OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.
- CVE-2026-66138In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a runni
- CVE-2026-54422In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extrac
- CVE-2026-54423In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use t
- CVE-2026-44918OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
- CVE-2026-50221In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Hos
- CVE-2026-55748OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metachara
- CVE-2026-46448In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data.
- CVE-2026-54421In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return
- CVE-2026-50589In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or J
- CVE-2026-50266In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set devic
- CVE-2026-48681OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
- CVE-2026-44917OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a p
- CVE-2026-41283OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed.
- CVE-2026-46447OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info
- CVE-2026-49299In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defi
- CVE-2026-44394An issue was discovered in OpenStack Keystone before 29.0.2.
- CVE-2026-43000An issue was discovered in OpenStack Keystone before 29.0.2.
- CVE-2026-42999An issue was discovered in OpenStack Keystone before 29.0.2.
- CVE-2026-42998An issue was discovered in OpenStack Keystone before 29.0.2.
- CVE-2026-49017In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bo
- CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///
- CVE-2026-44916In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
- CVE-2026-40214In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer.
- CVE-2026-40213OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints.
- CVE-2026-43002An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3.