Openstack vulnerabilities
77 CVEs and advisories name Openstack as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-42997An issue was discovered in idrac in OpenStack Ironic before 35.0.1.
- CVE-2026-43003An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.
- CVE-2026-43001An issue was discovered in OpenStack Keystone before 29.0.2.
- CVE-2026-42510OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
- CVE-2026-40683In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enable
- CVE-2026-40212OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wr
- CVE-2026-33551An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.
- CVE-2026-34881OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF).
- CVE-2026-28370In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger cod
- CVE-2026-24708An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1.
- CVE-2026-22797An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.1
- CVE-2025-65073OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Ke
- CVE-2025-44021OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the
- CVE-2022-38065A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior.
- CVE-2022-38060A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618.
- CVE-2013-2255HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side
- CVE-2017-12155A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world