Openstack - vulnerabilities (CVEs)

335 CVEs in 79 products, 10 in the last 30 days, newest from 2026-10-23.

Products

Keystone - 50 CVEs
Nova - 40 CVEs
Neutron - 29 CVEs
Folsom - 25 CVEs
Horizon - 24 CVEs
Ironic - 19 CVEs
Swift - 19 CVEs
Essex - 15 CVEs
Image Registry And Delivery Service (glance) - 15 CVEs
Glance - 14 CVEs
Grizzly - 14 CVEs
Compute - 12 CVEs
Havana - 11 CVEs
Cinder - 9 CVEs
Heat - 7 CVEs
Python-keystoneclient - 7 CVEs
Barbican - 5 CVEs
Mistral - 5 CVEs
Octavia - 5 CVEs
Tripleo Heat Templates - 5 CVEs
Designate - 4 CVEs
Icehouse - 4 CVEs
Keystonemiddleware - 4 CVEs
Ironic Python Agent - 3 CVEs
Manila - 3 CVEs
Trove - 3 CVEs
Zaqar - 3 CVEs
Blazar - 2 CVEs
Ceilometer - 2 CVEs
Cloud Magnum Orchestration - 2 CVEs
Cyborg - 2 CVEs
Diablo - 2 CVEs
Keystone Essex - 2 CVEs
Magnum - 2 CVEs
Murano - 2 CVEs
Openstack - 2 CVEs
Oslo - 2 CVEs
Tripleo Ansible - 2 CVEs
Aodh - 1 CVEs
Blazar-dashboard - 1 CVEs
Cinder Folsom - 1 CVEs
Compute (nova) - 1 CVEs
Compute (nova) Essex - 1 CVEs
Compute (nova) Folsom - 1 CVEs
Devstack - 1 CVEs
Glance-store - 1 CVEs
Instack-undercloud - 1 CVEs
Ironic-inspector - 1 CVEs
Ironic-python-agent - 1 CVEs
Ironic Inspector - 1 CVEs
Juno - 1 CVEs
Kilo - 1 CVEs
Kolla - 1 CVEs
Magnum-yoga-eom - 1 CVEs
Mitaka-murano - 1 CVEs
Murano-dashboard - 1 CVEs
Nova-lxd - 1 CVEs
Openstack-tripleo-heat-templates - 1 CVEs
Orchestration Api - 1 CVEs
Os-vif - 1 CVEs
Oslo.middleware - 1 CVEs
Oslo.utils - 1 CVEs
Puppet-gerrit - 1 CVEs
Puppet-swift - 1 CVEs
Puppet-tripleo - 1 CVEs
Pycadf - 1 CVEs
Python-muranoclient - 1 CVEs
Python Glanceclient - 1 CVEs
Skyline - 1 CVEs
Solum-yoga-eom - 1 CVEs
Storlets - 1 CVEs
Swauth - 1 CVEs
Swift3 - 1 CVEs
Telemetry (ceilometer) - 1 CVEs
Tripleo-common - 1 CVEs
Vitrage - 1 CVEs
Yaql - 1 CVEs
Glance Store - 0 CVEs
Oslo-incubator - 0 CVEs

Newest CVEs of Openstack

CVE-2026-90458 - CVSS 5.4 (medium), 2026-10-23: OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
CVE-2026-89419 - CVSS 5 (medium), 2026-10-23: OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…
CVE-2026-115638 - CVSS 4.3 (medium), 2026-10-23: OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
CVE-2026-93856 - CVSS 4.3 (medium), 2026-10-21: In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or…
CVE-2026-71195 - CVSS 9.9 (critical), 2026-10-21: In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize…
CVE-2026-97147 - CVSS 7.2 (high), 2026-10-08: In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then…
CVE-2026-93861 - CVSS 6 (medium), 2026-10-08: In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a…
CVE-2026-93860 - CVSS 7.1 (high), 2026-10-08: In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any…
CVE-2026-93858 - CVSS 8.7 (high), 2026-10-08: In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any…
CVE-2026-107363 - CVSS 6.1 (medium), 2026-10-07: In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the…
CVE-2026-97404 - CVSS 9.2 (critical), 2026-09-24: In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an…
CVE-2026-97149 - CVSS 5.3 (medium), 2026-09-24: In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method,…
CVE-2026-94572 - CVSS 9.4 (critical), 2026-09-21: In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is…
CVE-2026-94571 - CVSS 9.4 (critical), 2026-09-21: In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields.…
CVE-2026-93854 - CVSS 7.2 (high), 2026-09-18: In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id}…
CVE-2026-93852 - CVSS 7.1 (high), 2026-09-18: In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an…
CVE-2026-71198 - CVSS 7 (high), 2026-09-14: In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download…
CVE-2026-90461 - CVSS 6.3 (medium), 2026-09-11: OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
CVE-2026-90460 - CVSS 7.6 (high), 2026-09-11: An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials,…
CVE-2026-80183 - CVSS 7.1 (high), 2026-08-26: In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…
CVE-2026-80184 - CVSS 7.6 (high), 2026-08-25: In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be…
CVE-2026-80182 - CVSS 7.6 (high), 2026-08-25: In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new…
CVE-2026-77648 - CVSS 2.2 (low), 2026-08-20: In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs…
CVE-2026-76878 - CVSS 8.4 (high), 2026-08-19: In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the…
CVE-2026-74250 - CVSS 6.3 (medium), 2026-08-14: In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect…
CVE-2026-74248 - CVSS 4.3 (medium), 2026-08-14: OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an…
CVE-2026-71194 - CVSS 6.8 (medium), 2026-08-12: In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the…
CVE-2026-71193 - CVSS 9.6 (critical), 2026-08-12: In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool…
CVE-2026-71201 - CVSS 5 (medium), 2026-08-05: In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another…
CVE-2026-71192 - CVSS 6 (medium), 2026-08-05: In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests…