6 mentions in 7 days · 6 in 30 days · 6 total · first seen · last
Ubuntu warns an authenticated OpenStack Swift bug can cause a denial of service.
Ubuntu security notice USN-8821-1 says OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could make Swift consume excessive resources and cause a denial of service. The notice does not name a CVE or report exploitation in the wild.
OpenStack Zaqar advisory CVE-2026-97404: an empty URL-Signature header can bypass authentication.
OpenStack Security Advisory OSSA-2026-042 discloses CVE-2026-97404 in the Zaqar messaging service. An empty URL-Signature header can bypass authentication. An independent security researcher reported the flaw, and the notice lists affected Zaqar releases with 22.0.2 as a fix boundary. The advisory does not say the bug is being exploited.
OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.
OpenStack published OSSA-2026-041 for CVE-2026-97149, a cross-container information disclosure in Swift's tempurl feature. The issue, reported by Oren Yomtov of ACT Security, affects Swift from version 1.4.6, and the advisory lists the 2.36.0 and 2.37.0 lines and releases before 2.38.2. The posted notice does not say the flaw is being exploited.
OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.
OpenStack published OSSA-2026-039, dated 21 September 2026, warning that HAProxy configuration injection in Octavia can lead to remote code execution. The issue is tracked as CVE-2026-94572 and CVE-2026-94571. Affected versions are Octavia 0.8.0 through releases before 16.1.0, as well as 17.0.0 and 18.0.0. The published excerpt does not say the flaw is being exploited.
OpenStack Blazar's V2 lease API has authorization flaws CVE-2026-93852 and CVE-2026-93854.
OpenStack published OSSA-2026-040 on September 21, 2026, describing multiple authorization vulnerabilities in the Blazar V2 lease API. CVE-2026-93852 and CVE-2026-93854 affect Blazar from 1.0.0 before 15.1.1, as well as versions 16.0.0 and 17.0.0. Rohan Das is credited with the report. The disclosure does not say the flaws are being exploited.
OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.
OpenStack Security Advisory OSSA-2026-039, dated 21 September 2026, describes HAProxy configuration injection that can lead to remote code execution in Octavia. Affected releases are Octavia 0.8.0 up to but not including 16.1.0, as well as 17.0.0 and 18.0.0. The notice lists the issue as CVE-2026-pending, and the posted text does not report observed exploitation.