OpenStack vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-90458 New	IR Ironic OpenStack	5.4	0%	Oct 23	OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service
CVE-2026-89419 New	IR Ironic OpenStack	5.0	0%	Oct 23	OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific…
CVE-2026-115638 New	IR Ironic OpenStack	4.3	0%	Oct 23	OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb
CVE-2026-93856	CI Cinder OpenStack	4.3	0%	Oct 21	In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
CVE-2026-71195	MA Manila OpenStack	9.9	0%	Oct 21	In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share
CVE-2026-97147	MI Mistral OpenStack	7.2	0%	Oct 8	In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it
CVE-2026-93861	MI Mistral OpenStack	6.0	0%	Oct 8	In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming…
CVE-2026-93860	MI Mistral OpenStack	7.1	0%	Oct 8	In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement
CVE-2026-93858	MI Mistral OpenStack	8.7	0%	Oct 8	In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a…
CVE-2026-107363	ZA Zaqar OpenStack	6.1	0%	Oct 7	In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token
CVE-2026-97404	ZA Zaqar OpenStack	9.2	0%	Sep 24	In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header
CVE-2026-97149	SW Swift OpenStack	5.3	0%	Sep 24	In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests
CVE-2026-94572	OC Octavia OpenStack	9.4	1%	Sep 21	In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters
CVE-2026-94571	OC Octavia OpenStack	9.4	1%	Sep 21	In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields
CVE-2026-93854	BL Blazar OpenStack	7.2	0%	Sep 18	In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE…
CVE-2026-93852	BL Blazar OpenStack	7.1	0%	Sep 18	In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only…
CVE-2026-71198	GL Glance OpenStack	7.0	0%	Sep 14	In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image
CVE-2026-90461	IR Ironic OpenStack	6.3	0%	Sep 11	OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication
CVE-2026-90460	KE Keystone OpenStack	7.6	1%	Sep 11	An issue was discovered in OpenStack Keystone before 29.0.3
CVE-2026-80183	KE Keystone OpenStack	7.1	0%	Aug 26	In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain…
CVE-2026-80184	KE Keystone OpenStack	7.6	1%	Aug 25	In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the…
CVE-2026-80182	KE Keystone OpenStack	7.6	1%	Aug 25	In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or…
CVE-2026-77648	GL Glance OpenStack	2.2	0%	Aug 20	In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service…
CVE-2026-76878	AO Aodh OpenStack	8.4	1%	Aug 19	In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false
CVE-2026-74250	IR Ironic OpenStack	6.3	0%	Aug 14	In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface
CVE-2026-74248	OC Octavia OpenStack	4.3	0%	Aug 14	OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization
CVE-2026-71194	DE Designate OpenStack	6.8	1%	Aug 12	In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests
CVE-2026-71193	DE Designate OpenStack	9.6	1%	Aug 12	In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only
CVE-2026-71201	IR Ironic OpenStack	5.0	0%	Aug 5	In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project
CVE-2026-71192	SW Swift OpenStack	6.0	0%	Aug 5	In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true
CVE-2026-71191	SW Swift OpenStack	6.0	1%	Aug 5	In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests
CVE-2026-71190	SW Swift OpenStack	8.7	1%	Aug 5	In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS)
CVE-2026-55707	NE Neutron OpenStack	7.1	0%	Aug 5	In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets
CVE-2026-66139	ZA Zaqar OpenStack	4.8	0%	Jul 24	OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known
CVE-2026-66138	IP Ironic Python Agent OpenStack	7.2	0%	Jul 24	In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a…
CVE-2026-54422	IP Ironic Python Agent OpenStack	5.5	0%	Jul 24	In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it
CVE-2026-54423	IR Ironic OpenStack	8.2	0%	Jul 10	In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI…
CVE-2026-44918	IR Ironic OpenStack	5.5	0%	Jul 10	OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization
CVE-2026-50221	SW Swift OpenStack	5.4	0%	Jun 23	In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client…
CVE-2026-55748	HO Horizon OpenStack	6.8	0%	Jun 17	OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters
CVE-2026-46448	NO Nova OpenStack	8.5	0%	Jun 16	In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data
CVE-2026-54421	IR Ironic OpenStack	6.8	0%	Jun 14	In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such…
CVE-2026-50589	IR Ironic Openstack	7.5	0%	Jun 4	In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service…
CVE-2026-50266	NE Neutron OpenStack	2.2	0%	Jun 4	In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:"…
CVE-2026-44917	IR Ironic OpenStack	4.9	0%	Jun 4	OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template
CVE-2026-48681	IR Ironic OpenStack	8.1	1%	Jun 4	OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image
CVE-2026-41283	MI Mistral OpenStack	9.9	1%	Jun 4	OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed
CVE-2026-46447	IR Ironic OpenStack	7.7	0%	Jun 3	OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info
CVE-2026-49299	NE Neutron OpenStack	5.3	0%	May 28	In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names
CVE-2026-42998	KE Keystone OpenStack	8.8	0%	May 28	An issue was discovered in OpenStack Keystone before 29.0.2
CVE-2026-43000	KE Keystone OpenStack	8.8	0%	May 28	An issue was discovered in OpenStack Keystone before 29.0.2
CVE-2026-42999	KE Keystone OpenStack	8.8	0%	May 28	An issue was discovered in OpenStack Keystone before 29.0.2
CVE-2026-44394	KE Keystone OpenStack	8.1	0%	May 28	An issue was discovered in OpenStack Keystone before 29.0.2
CVE-2026-49017	SW Swift OpenStack	6.5	0%	May 27	In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
CVE-2026-44919	IR Ironic OpenStack	6.5	0%	May 14	In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL
CVE-2026-44916	IR Ironic OpenStack	3.0	0%	May 8	In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing
CVE-2026-40214	CY Cyborg OpenStack	6.3	0%	May 7	In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer
CVE-2026-40213	CY Cyborg OpenStack	7.4	0%	May 7	OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints
CVE-2026-43002	HO Horizon OpenStack	5.3	0%	May 5	An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3
CVE-2026-42997	IR Ironic OpenStack	7.7	0%	May 5	An issue was discovered in idrac in OpenStack Ironic before 35.0.1