[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
OpenStack Mistral has four authorization and privilege flaws in OSSA-2026-044.
62
Organization
OpenStack
- Mentions · 7d0
- Mentions · 30d0
- All mentions12
- First seenSep 21, 2026
- Last mentionedOct 9, 2026
Timeline
12 articles · newest first[OSSN-0109] Cross-project metric association bypass in Gnocchi
OpenStack Gnocchi lets authenticated users attach metrics to other projects' resources, bypassing authorization checks.
46
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1
OpenStack assigned CVE-2026-107363 to a Zaqar WebSocket flaw enabling cross-project queue access.
52
[OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pending)
OpenStack Zaqar WebSocket project substitution flaw permits cross-project queue access across multiple releases, fixed in 22.0.3 and 23.0.1.
45
USN-8860-1: OpenStack Designate vulnerability
Ubuntu warns OpenStack Designate may let authenticated users redirect DNS or cause a denial of service.
36
USN-8854-1: OpenStack Keystone vulnerabilities
Ubuntu patches OpenStack Keystone flaws that can extend delegated tokens and leak role data.
34
USN-8821-1: OpenStack Swift vulnerability
Ubuntu warns an authenticated OpenStack Swift bug can cause a denial of service.
24
[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)
OpenStack Zaqar advisory CVE-2026-97404: an empty URL-Signature header can bypass authentication.
62
[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)
OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.
51
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)
OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.
67
[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)
OpenStack Blazar's V2 lease API has authorization flaws CVE-2026-93852 and CVE-2026-93854.
46
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)
OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.
64
Related CVEs
by mentions- HAProxy Config Injection in OpenStack Octavia Amphora Driver via tls_ciphers
- HAProxy Config Injection via L7 Policy Redirect Fields in OpenStack Octavia
- Command injection in OpenStack Mistral std.ssh_proxied
- CVE-2026-80182<1%7.6In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new…
- Incorrect authorization in OpenStack Mistral API writes
- Broken Object-Level Authorization in OpenStack Blazar Lease API
- Missing authorization in OpenStack Mistral maintenance API
- CVE-2026-80183<1%7.1In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…
- Cross-project queue access in OpenStack Zaqar WebSocket
- Authorization bypass in OpenStack Mistral workflow sharing
Appears with
- OpenStackvendor · 8
- Octaviaproduct · 2
- Canonicalvendor · 2
- OpenStack Swiftproduct · 2
- HAProxyproduct · 2
- Zaqarproduct · 2
- Ubuntuproduct · 2
- Canonicalorganization · 1
- Ubuntuorganization · 1
- Gnocchiproduct · 1
- ACT Securityorganization · 1
- OpenStack Designateproduct · 1
- Mistralproduct · 1
- Blazarproduct · 1
- OpenStack Keystoneproduct · 1
- Ubuntuvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.