Openstack vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.Critical 9.9 · Oct 21, 2026
• CVE-2026-97147 In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then wHigh 7.2 · Oct 8, 2026
• CVE-2026-93860 In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policyHigh 7.1 · Oct 8, 2026
• CVE-2026-93858 In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH High 8.7 · Oct 8, 2026
• CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.Critical 9.2 · Sep 24, 2026
• CVE-2026-94572 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters.Critical 9.4 · Sep 21, 2026
• CVE-2026-94571 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields.Critical 9.4 · Sep 21, 2026
• CVE-2026-93854 In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} aHigh 7.2 · Sep 18, 2026
• CVE-2026-93852 In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an admiHigh 7.1 · Sep 18, 2026
• CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image.High 7 · Sep 14, 2026
• CVE-2026-90460 An issue was discovered in OpenStack Keystone before 29.0.3.High 7.6 · Sep 11, 2026
• CVE-2026-80183 In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain byHigh 7.1 · Aug 26, 2026
• CVE-2026-80184 In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be suHigh 7.6 · Aug 25, 2026
• CVE-2026-80182 In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-livedHigh 7.6 · Aug 25, 2026
• CVE-2026-76878 In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false.High 8.4 · Aug 19, 2026
• CVE-2026-71193 In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool onlyCritical 9.6 · Aug 12, 2026
• CVE-2026-71190 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS).High 8.7 · Aug 5, 2026
• CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets.High 7.1 · Aug 5, 2026
• CVE-2026-66138 In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-AgeHigh 7.2 · Jul 24, 2026
• CVE-2026-54423 In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to High 8.2 · Jul 10, 2026
• CVE-2026-41283 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed.Critical 9.9 · Jun 4, 2026
• CVE-2026-49017 In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body.High 7.1 · May 26, 2026
• CVE-2026-40213 OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints.High 7.4 · May 7, 2026
• CVE-2026-42997 An issue was discovered in idrac in OpenStack Ironic before 35.0.1.High 7.7 · May 5, 2026
• CVE-2026-43003 An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.High 8 · May 1, 2026