OpenStack (Vendor): news timeline & CVEs

[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)

OpenStack Zaqar advisory CVE-2026-97404: an empty URL-Signature header can bypass authentication.

OpenStack Security Advisory OSSA-2026-042 discloses CVE-2026-97404 in the Zaqar messaging service. An empty URL-Signature header can bypass authentication. An independent security researcher reported the flaw, and the notice lists affected Zaqar releases with 22.0.2 as a fix boundary. The advisory does not say the bug is being exploited.

oss-securitySep 24, 16:33 UTC · 2d agoVulnerability CVE-2026-97404

[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)

OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.

OpenStack published OSSA-2026-041 for CVE-2026-97149, a cross-container information disclosure in Swift's tempurl feature. The issue, reported by Oren Yomtov of ACT Security, affects Swift from version 1.4.6, and the advisory lists the 2.36.0 and 2.37.0 lines and releases before 2.38.2. The posted notice does not say the flaw is being exploited.

oss-securityupdated Sep 24, 19:18 UTC · 2d agofirst Sep 24, 16:31 UTC · 2d agoVulnerability 2 sources CVE-2026-97149

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)

OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.

OpenStack published OSSA-2026-039, dated 21 September 2026, warning that HAProxy configuration injection in Octavia can lead to remote code execution. The issue is tracked as CVE-2026-94572 and CVE-2026-94571. Affected versions are Octavia 0.8.0 through releases before 16.1.0, as well as 17.0.0 and 18.0.0. The published excerpt does not say the flaw is being exploited.

oss-securityupdated Sep 24, 12:38 UTC · 2d agofirst Sep 22, 15:59 UTC · 4d agoVulnerability 3 sources CVE-2026-94572 CVE-2026-94571

[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)

OpenStack Blazar's V2 lease API has authorization flaws CVE-2026-93852 and CVE-2026-93854.

OpenStack published OSSA-2026-040 on September 21, 2026, describing multiple authorization vulnerabilities in the Blazar V2 lease API. CVE-2026-93852 and CVE-2026-93854 affect Blazar from 1.0.0 before 15.1.1, as well as versions 16.0.0 and 17.0.0. Rohan Das is credited with the report. The disclosure does not say the flaws are being exploited.

oss-securitySep 21, 17:20 UTC · 5d agoVulnerability CVE-2026-93852 CVE-2026-938542

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)

OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.

OpenStack Security Advisory OSSA-2026-039, dated 21 September 2026, describes HAProxy configuration injection that can lead to remote code execution in Octavia. Affected releases are Octavia 0.8.0 up to but not including 16.1.0, as well as 17.0.0 and 18.0.0. The notice lists the issue as CVE-2026-pending, and the posted text does not report observed exploitation.

oss-securityupdated Sep 24, 12:38 UTC · 2d agofirst Sep 21, 17:18 UTC · 5d agoVulnerability 3 sources

OpenStack

Timeline5 articles

Related CVEsby mentions

Appears with

[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)

[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)

[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)