OpenStack keystonemiddleware access_rules bypass via X-Service-Token
OSSA-2026-050 names CVE-2026-115642 and lists several Keystonemiddleware releases, but the posted description is cut off.
Stories per day · 30 days
3 RSS
Relatedossa4ironic3access-control2metal32cinder1cloud1denial-of-service1gzip-bomb1information-disclosure1key-exposure1keystonemiddleware1luks1manila1node-management1oslo.utils1ossn1path-injection1redfish1
21 stories, newest first · one card per story
Stories tagged #openstack
OpenStack Ironic conductor DoS via gzip-bomb configdrive
OSSA-2026-049 assigns CVE-2026-115638 and lists Ironic lines from 16.2.0 through builds before 39.0.1.
oslo.utils can log LUKS key material from LUKSv1 images
OSSN-0111 says a passphrase inspection can log enough material to decrypt the image; versions are not in the excerpt.
Ironic Redfish vendor_passthru allows path injection (CVE-2026-90458)
OSSA-2026-047 lists Ironic from 18.1.0 through 39.0.1; the snippet does not name a fix.
OpenStack Manila allows cross-project share changes (CVE-2026-71195)
OSSA-2026-046, dated October 20, lists affected Manila lines including releases before 22.0.2 and version 23.0.0; the description is cut off.
Cinder Messages API can disclose cross-project data (CVE-2026-93856)
The notice lists Cinder 9.0.0 before 26.3.1 and the exact releases 27.0.0, 28.0.0, and 29.0.0.
[OSSN-0110] Ironic can leak basic auth credentials to image server
OpenStack Ironic can leak HTTP basic-auth credentials to a configured image server.
[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
OpenStack Mistral has four authorization and privilege flaws in OSSA-2026-044.
[OSSN-0109] Cross-project metric association bypass in Gnocchi
OpenStack Gnocchi lets authenticated users attach metrics to other projects' resources, bypassing authorization checks.
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1
OpenStack assigned CVE-2026-107363 to a Zaqar WebSocket flaw enabling cross-project queue access.
USN-8870-1: OpenStack Aodh and Watcher vulnerability
Ubuntu warns OpenStack Aodh and Watcher flaws can leak alarm metadata or trigger unauthorized action plans.
USN-8860-1: OpenStack Designate vulnerability
Ubuntu warns OpenStack Designate may let authenticated users redirect DNS or cause a denial of service.
USN-8854-1: OpenStack Keystone vulnerabilities
Ubuntu patches OpenStack Keystone flaws that can extend delegated tokens and leak role data.
OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised
Attackers breached OpenInfra Europe's JFrog Artifactory via CVE-2026-82329, potentially compromising downloaded packages.
3
USN-8821-1: OpenStack Swift vulnerability
Ubuntu warns an authenticated OpenStack Swift bug can cause a denial of service.
[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)
OpenStack Zaqar advisory CVE-2026-97404: an empty URL-Signature header can bypass authentication.
[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)
OpenStack Swift tempurl bug CVE-2026-97149 can leak information across containers.
USN-8814-1: Octavia vulnerabilities
Ubuntu patches multiple OpenStack Octavia flaws allowing authenticated load-balancer owners to inject arbitrary HAProxy configuration directives.
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)
OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.
[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)
OpenStack Blazar's V2 lease API has authorization flaws CVE-2026-93852 and CVE-2026-93854.
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)
OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.