OpenStack keystonemiddleware access_rules bypass via X-Service-Token
OSSA-2026-050 names CVE-2026-115642 and lists several Keystonemiddleware releases, but the posted description is cut off.
52
Vendor
OpenStack
- Mentions · 7d0
- Mentions · 30d7
- All mentions17
- First seenSep 21, 2026
- Last mentioned13d ago
Timeline
17 articles · newest firstOpenStack Ironic conductor DoS via gzip-bomb configdrive
OSSA-2026-049 assigns CVE-2026-115638 and lists Ironic lines from 16.2.0 through builds before 39.0.1.
48
oslo.utils can log LUKS key material from LUKSv1 images
OSSN-0111 says a passphrase inspection can log enough material to decrypt the image; versions are not in the excerpt.
52
Ironic node update can change maintenance setting (CVE-2026-89419)
OSSA-2026-048 lists Ironic from 17.0.0 through 39.0.1; the posted description is cut off.
40
Ironic Redfish vendor_passthru allows path injection (CVE-2026-90458)
OSSA-2026-047 lists Ironic from 18.1.0 through 39.0.1; the snippet does not name a fix.
48
OpenStack Manila allows cross-project share changes (CVE-2026-71195)
OSSA-2026-046, dated October 20, lists affected Manila lines including releases before 22.0.2 and version 23.0.0; the description is cut off.
52
Cinder Messages API can disclose cross-project data (CVE-2026-93856)
The notice lists Cinder 9.0.0 before 26.3.1 and the exact releases 27.0.0, 28.0.0, and 29.0.0.
48
[OSSN-0110] Ironic can leak basic auth credentials to image server
OpenStack Ironic can leak HTTP basic-auth credentials to a configured image server.
48
[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
OpenStack Mistral has four authorization and privilege flaws in OSSA-2026-044.
62
[OSSN-0109] Cross-project metric association bypass in Gnocchi
OpenStack Gnocchi lets authenticated users attach metrics to other projects' resources, bypassing authorization checks.
46
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1
OpenStack assigned CVE-2026-107363 to a Zaqar WebSocket flaw enabling cross-project queue access.
52
USN-8870-1: OpenStack Aodh and Watcher vulnerability
Ubuntu warns OpenStack Aodh and Watcher flaws can leak alarm metadata or trigger unauthorized action plans.
44
[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)
OpenStack Zaqar advisory CVE-2026-97404: an empty URL-Signature header can bypass authentication.
62
[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)
OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.
51
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)
OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.
67
[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)
OpenStack Blazar's V2 lease API has authorization flaws CVE-2026-93852 and CVE-2026-93854.
46
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)
OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.
64
Related CVEs
by mentions- Missing ownership checks on public shares in OpenStack Manila before 23.0.1
- HAProxy Config Injection via L7 Policy Redirect Fields in OpenStack Octavia
- HAProxy Config Injection in OpenStack Octavia Amphora Driver via tls_ciphers
- Command injection in OpenStack Mistral std.ssh_proxied
- Access-rules bypass in OpenStack keystonemiddleware before 13.0.2
- Broken Object-Level Authorization in OpenStack Blazar Lease API
- Incorrect authorization in OpenStack Mistral API writes
- OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service
- OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…
- In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
Appears with
- OpenStackorganization · 8
- Ironicproduct · 4
- Zaqarproduct · 2
- HAProxyproduct · 2
- Octaviaproduct · 2
- Metal3.ioorganization · 2
- Metal3.io Securityorganization · 1
- OVHcloudorganization · 1
- Blazarproduct · 1
- Gnocchiproduct · 1
- OpenStack Watcherproduct · 1
- Cinderproduct · 1
- Ubuntuorganization · 1
- OpenStack Aodhproduct · 1
- Ericsson Software Technologyorganization · 1
- Keystonemiddlewareproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.