Cinder (Openstack) - vulnerabilities (CVEs)
9 CVEs, 1 in the last 30 days, 271 known versions, newest CVE from 2026-10-21. Vendor: Openstack.
CVEs of Cinder
- CVE-2026-93856 - CVSS 4.3 (medium), 2026-10-21: In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or…
- CVE-2024-32498 - CVSS 6.5 (medium), 2024-07-05: An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2…
- CVE-2022-47951 - CVSS 5.7 (medium), 2023-01-26: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova…
- CVE-2017-15139 - CVSS 7.5 (high), 2018-08-27: A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to…
- CVE-2015-5162 - CVSS 7.5 (high), 2016-10-07: The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit…
- CVE-2014-7231 - CVSS 2.1 (low), 2014-10-08: The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not…
- CVE-2014-7230 - CVSS 2.1 (low), 2014-10-08: The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain…
- CVE-2014-3641 - CVSS 4 (medium), 2014-10-08: The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume…
- CVE-2013-4202 - CVSS 4.3 (medium), 2013-09-16: The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows…
- CVE-2013-4183 - CVSS 2.1 (low), 2013-09-16: The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which…
