{"items":[{"id":"CVE-2026-115642","published":"2026-10-30T16:23:23.404Z","updated":"2026-10-30T17:07:49.860Z","title":"In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted…","severity":"HIGH","score":8.3,"vendor":"OpenStack","product":"keystonemiddleware","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-90458","published":"2026-10-23T03:50:48.611Z","updated":"2026-10-29T12:46:14.679Z","title":"OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.","severity":"MEDIUM","score":5.4,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-89419","published":"2026-10-23T03:44:09.648Z","updated":"2026-11-02T14:57:22.596Z","title":"OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…","severity":"MEDIUM","score":5,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-115638","published":"2026-10-23T03:21:17.303Z","updated":"2026-10-29T17:05:16.854Z","title":"OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.","severity":"MEDIUM","score":4.3,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-93856","published":"2026-10-21T05:36:39.501Z","updated":"2026-10-21T18:54:14.090Z","title":"In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or…","severity":"MEDIUM","score":4.3,"vendor":"OpenStack","product":"Cinder","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-71195","published":"2026-10-21T05:31:56.019Z","updated":"2026-10-27T22:03:10.886Z","title":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize…","severity":"CRITICAL","score":9.9,"vendor":"OpenStack","product":"Manila","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2026-97147","published":"2026-10-08T17:41:29.934Z","updated":"2026-10-14T01:07:30.221Z","title":"In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then…","severity":"HIGH","score":7.2,"vendor":"OpenStack","product":"Mistral","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-93861","published":"2026-10-08T17:38:43.892Z","updated":"2026-10-15T18:10:06.319Z","title":"In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Mistral","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-93860","published":"2026-10-08T17:35:43.653Z","updated":"2026-10-09T11:42:46.119Z","title":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any…","severity":"HIGH","score":7.1,"vendor":"OpenStack","product":"Mistral","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2026-93858","published":"2026-10-08T17:28:58.167Z","updated":"2026-10-08T17:56:35.058Z","title":"In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH…","severity":"HIGH","score":8.7,"vendor":"OpenStack","product":"Mistral","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-107363","published":"2026-10-07T20:08:47.548Z","updated":"2026-10-07T23:06:46.671Z","title":"In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the…","severity":"MEDIUM","score":6.1,"vendor":"OpenStack","product":"Zaqar","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-97404","published":"2026-09-24T14:34:16.863Z","updated":"2026-09-26T22:51:19.916Z","title":"In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an…","severity":"CRITICAL","score":9.2,"vendor":"OpenStack","product":"Zaqar","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-97149","published":"2026-09-24T02:25:49.093Z","updated":"2026-10-06T17:42:19.236Z","title":"In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method,…","severity":"MEDIUM","score":5.3,"vendor":"OpenStack","product":"Swift","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-94572","published":"2026-09-21T20:13:35.557Z","updated":"2026-09-24T22:41:15.736Z","title":"In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is…","severity":"CRITICAL","score":9.4,"vendor":"OpenStack","product":"Octavia","kev":false,"epss":0.00534,"kevAdded":null},{"id":"CVE-2026-94571","published":"2026-09-21T20:09:16.848Z","updated":"2026-09-22T13:36:39.179Z","title":"In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The…","severity":"CRITICAL","score":9.4,"vendor":"OpenStack","product":"Octavia","kev":false,"epss":0.00534,"kevAdded":null},{"id":"CVE-2026-93854","published":"2026-09-18T18:57:56.107Z","updated":"2026-09-22T15:19:34.210Z","title":"In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id}…","severity":"HIGH","score":7.2,"vendor":"OpenStack","product":"Blazar","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-93852","published":"2026-09-18T18:48:34.899Z","updated":"2026-09-18T19:47:14.422Z","title":"In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an…","severity":"HIGH","score":7.1,"vendor":"OpenStack","product":"Blazar","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-71198","published":"2026-09-14T06:54:21.860Z","updated":"2026-09-14T14:41:21.586Z","title":"In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download…","severity":"HIGH","score":7,"vendor":"OpenStack","product":"Glance","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-90461","published":"2026-09-11T21:32:33.740Z","updated":"2026-10-09T07:17:35.422Z","title":"OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.","severity":"MEDIUM","score":6.3,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-90460","published":"2026-09-11T21:22:35.809Z","updated":"2026-10-13T16:09:19.997Z","title":"An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials,…","severity":"HIGH","score":7.6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-80183","published":"2026-08-26T23:16:43.059Z","updated":"2026-08-27T14:08:09.543Z","title":"In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…","severity":"HIGH","score":7.1,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-80184","published":"2026-08-25T21:29:29.471Z","updated":"2026-08-26T14:37:45.384Z","title":"In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be…","severity":"HIGH","score":7.6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-80182","published":"2026-08-25T21:19:10.189Z","updated":"2026-08-26T14:38:22.666Z","title":"In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new…","severity":"HIGH","score":7.6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-77648","published":"2026-08-20T22:37:31.431Z","updated":"2026-08-24T16:00:10.928Z","title":"In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs…","severity":"LOW","score":2.2,"vendor":"OpenStack","product":"Glance","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-76878","published":"2026-08-19T22:04:56.091Z","updated":"2026-08-21T01:30:49.666Z","title":"In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the…","severity":"HIGH","score":8.4,"vendor":"OpenStack","product":"Aodh","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-74250","published":"2026-08-14T22:53:18.274Z","updated":"2026-08-17T15:38:11.060Z","title":"In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect…","severity":"MEDIUM","score":6.3,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-74248","published":"2026-08-14T20:20:31.446Z","updated":"2026-08-17T21:07:01.668Z","title":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an…","severity":"MEDIUM","score":4.3,"vendor":"OpenStack","product":"Octavia","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-71194","published":"2026-08-12T22:23:46.951Z","updated":"2026-08-13T13:32:41.548Z","title":"In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the…","severity":"MEDIUM","score":6.8,"vendor":"OpenStack","product":"Designate","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2026-71193","published":"2026-08-12T22:17:12.516Z","updated":"2026-08-13T13:35:19.251Z","title":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool…","severity":"CRITICAL","score":9.6,"vendor":"OpenStack","product":"Designate","kev":false,"epss":0.00525,"kevAdded":null},{"id":"CVE-2026-71201","published":"2026-08-05T06:19:33.524Z","updated":"2026-08-05T17:32:05.540Z","title":"In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another…","severity":"MEDIUM","score":5,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-71192","published":"2026-08-05T05:05:33.267Z","updated":"2026-08-05T13:31:30.582Z","title":"In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Swift","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2026-71191","published":"2026-08-05T05:01:20.971Z","updated":"2026-08-06T13:10:38.459Z","title":"In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Swift","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-71190","published":"2026-08-05T04:54:03.020Z","updated":"2026-08-06T13:09:17.168Z","title":"In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The…","severity":"HIGH","score":8.7,"vendor":"OpenStack","product":"Swift","kev":false,"epss":0.00836,"kevAdded":null},{"id":"CVE-2026-55707","published":"2026-08-05T04:44:16.572Z","updated":"2026-08-12T19:23:45.731Z","title":"In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets…","severity":"HIGH","score":7.1,"vendor":"OpenStack","product":"Neutron","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-66139","published":"2026-07-24T04:14:41.795Z","updated":"2026-07-24T23:22:06.300Z","title":"OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.","severity":"MEDIUM","score":4.8,"vendor":"OpenStack","product":"Zaqar","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-66138","published":"2026-07-24T03:53:12.142Z","updated":"2026-07-24T23:22:05.285Z","title":"In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running…","severity":"HIGH","score":7.2,"vendor":"OpenStack","product":"Ironic Python Agent","kev":false,"epss":0.00475,"kevAdded":null},{"id":"CVE-2026-54422","published":"2026-07-24T03:42:26.433Z","updated":"2026-07-24T12:26:32.687Z","title":"In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials…","severity":"MEDIUM","score":5.5,"vendor":"OpenStack","product":"Ironic Python Agent","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-54423","published":"2026-07-10T03:10:54.638Z","updated":"2026-07-10T15:25:59.292Z","title":"In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to…","severity":"HIGH","score":8.2,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-44918","published":"2026-07-10T00:00:00.000Z","updated":"2026-07-10T14:31:59.215Z","title":"OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.","severity":"MEDIUM","score":5.5,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-50221","published":"2026-06-23T17:03:32.971Z","updated":"2026-06-23T17:38:26.623Z","title":"In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host,…","severity":"MEDIUM","score":5.3,"vendor":"OpenStack","product":"Swift","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-55748","published":"2026-06-17T14:12:20.715Z","updated":"2026-06-17T15:40:12.791Z","title":"OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Horizon","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-46448","published":"2026-06-16T00:00:00.000Z","updated":"2026-06-17T12:17:30.606Z","title":"In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.","severity":"MEDIUM","score":5.4,"vendor":"OpenStack","product":"Nova","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-54421","published":"2026-06-14T03:49:37.996Z","updated":"2026-06-16T22:38:18.549Z","title":"In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted…","severity":"MEDIUM","score":6.8,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-50589","published":"2026-06-04T23:59:20.118Z","updated":"2026-07-16T12:04:41.741Z","title":"In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and…","severity":"MEDIUM","score":5.3,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2026-50266","published":"2026-06-04T16:18:39.167Z","updated":"2026-06-04T17:28:01.143Z","title":"In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value…","severity":"LOW","score":2.2,"vendor":"OpenStack","product":"Neutron","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-48681","published":"2026-06-04T00:00:00.000Z","updated":"2026-06-04T12:54:13.785Z","title":"OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.","severity":"MEDIUM","score":5.9,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-44917","published":"2026-06-04T00:00:00.000Z","updated":"2026-06-04T13:07:33.838Z","title":"OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.","severity":"MEDIUM","score":4.9,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-41283","published":"2026-06-04T00:00:00.000Z","updated":"2026-07-15T00:59:37.963Z","title":"OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead…","severity":"CRITICAL","score":9.9,"vendor":"OpenStack","product":"Mistral","kev":false,"epss":0.00733,"kevAdded":null},{"id":"CVE-2026-46447","published":"2026-06-03T00:00:00.000Z","updated":"2026-06-15T22:40:19.590Z","title":"OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.","severity":"MEDIUM","score":5.8,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2026-49299","published":"2026-05-28T21:53:03.408Z","updated":"2026-06-02T17:33:09.589Z","title":"In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules…","severity":"MEDIUM","score":5.3,"vendor":"OpenStack","product":"Neutron","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-44394","published":"2026-05-28T00:00:00.000Z","updated":"2026-05-28T19:43:05.616Z","title":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-43000","published":"2026-05-28T00:00:00.000Z","updated":"2026-07-24T12:05:28.766Z","title":"An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-42999","published":"2026-05-28T00:00:00.000Z","updated":"2026-07-24T12:05:37.538Z","title":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-42998","published":"2026-05-28T00:00:00.000Z","updated":"2026-05-28T19:38:42.097Z","title":"An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied…","severity":"MEDIUM","score":6,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-49017","published":"2026-05-27T01:57:58.831Z","updated":"2026-06-02T17:33:08.620Z","title":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The…","severity":"HIGH","score":7.1,"vendor":"OpenStack","product":"Swift","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-44919","published":"2026-05-14T00:00:00.000Z","updated":"2026-05-21T06:16:30.581Z","title":"In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.","severity":"MEDIUM","score":4.3,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-44916","published":"2026-05-08T06:38:37.279Z","updated":"2026-05-20T15:04:18.146Z","title":"In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.","severity":"LOW","score":3,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-40214","published":"2026-05-07T00:00:00.000Z","updated":"2026-05-08T15:47:39.031Z","title":"In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is…","severity":"MEDIUM","score":6.3,"vendor":"OpenStack","product":"Cyborg","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-40213","published":"2026-05-07T00:00:00.000Z","updated":"2026-05-08T15:47:07.733Z","title":"OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request…","severity":"HIGH","score":7.4,"vendor":"OpenStack","product":"Cyborg","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-43002","published":"2026-05-05T00:00:00.000Z","updated":"2026-05-06T06:05:23.992Z","title":"An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and…","severity":"MEDIUM","score":5.3,"vendor":"OpenStack","product":"Horizon","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-42997","published":"2026-05-05T00:00:00.000Z","updated":"2026-07-15T11:49:10.674Z","title":"An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote…","severity":"HIGH","score":7.7,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2026-43003","published":"2026-05-01T00:00:00.000Z","updated":"2026-09-09T12:04:49.482Z","title":"An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot…","severity":"HIGH","score":8,"vendor":"OpenStack","product":"ironic-python-agent","kev":false,"epss":0.00983,"kevAdded":null},{"id":"CVE-2026-43001","published":"2026-05-01T00:00:00.000Z","updated":"2026-08-14T12:04:29.310Z","title":"An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type…","severity":"HIGH","score":7.9,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-42510","published":"2026-04-28T04:53:10.789Z","updated":"2026-08-20T17:51:50.989Z","title":"OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.","severity":"MEDIUM","score":6.6,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.00567,"kevAdded":null},{"id":"CVE-2026-40683","published":"2026-04-14T20:05:03.274Z","updated":"2026-08-05T18:32:06.859Z","title":"In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert…","severity":"HIGH","score":7.7,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-40212","published":"2026-04-10T00:00:00.000Z","updated":"2026-04-10T15:32:11.199Z","title":"OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used…","severity":"MEDIUM","score":5.4,"vendor":"OpenStack","product":"Skyline","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-33551","published":"2026-04-10T00:00:00.000Z","updated":"2026-04-10T13:50:43.389Z","title":"An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2…","severity":"LOW","score":3.5,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-34881","published":"2026-03-31T05:29:08.449Z","updated":"2026-08-14T12:04:37.797Z","title":"OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated…","severity":"MEDIUM","score":5,"vendor":"OpenStack","product":"Glance","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-28370","published":"2026-02-27T04:56:25.453Z","updated":"2026-03-05T04:34:01.128Z","title":"In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the…","severity":"CRITICAL","score":9.1,"vendor":"OpenStack","product":"Vitrage","kev":false,"epss":0.00849,"kevAdded":null},{"id":"CVE-2026-24708","published":"2026-02-18T00:00:00.000Z","updated":"2026-09-11T12:09:05.112Z","title":"An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk…","severity":"HIGH","score":8.2,"vendor":"OpenStack","product":"Nova","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-22797","published":"2026-01-19T00:00:00.000Z","updated":"2026-09-10T12:05:03.991Z","title":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1.…","severity":"CRITICAL","score":9.9,"vendor":"OpenStack","product":"keystonemiddleware","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2025-65073","published":"2025-11-17T00:00:00.000Z","updated":"2025-11-17T23:04:04.827Z","title":"OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone…","severity":"HIGH","score":7.5,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-44021","published":"2025-05-08T00:00:00.000Z","updated":"2025-05-08T21:02:53.418Z","title":"OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious…","severity":"LOW","score":2.8,"vendor":"OpenStack","product":"Ironic","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2022-38065","published":"2022-12-21T23:14:33.786Z","updated":"2025-04-15T18:38:04.748Z","title":"A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality…","severity":"HIGH","score":8.8,"vendor":"OpenStack","product":"OpenStack","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2022-38060","published":"2022-12-21T23:14:33.786Z","updated":"2025-05-07T13:57:02.812Z","title":"A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a…","severity":"HIGH","score":8.8,"vendor":"OpenStack","product":"OpenStack","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2013-2255","published":"2019-11-01T18:38:01.000Z","updated":"2024-08-06T15:27:41.145Z","title":"HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.","severity":"MEDIUM","score":5.9,"vendor":"OpenStack","product":"Keystone","kev":false,"epss":0.0097,"kevAdded":null},{"id":"CVE-2017-12155","published":"2017-12-12T20:00:00.000Z","updated":"2024-09-16T17:22:48.181Z","title":"A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local…","severity":"MEDIUM","score":6.3,"vendor":"OpenStack","product":"openstack-tripleo-heat-templates","kev":false,"epss":0.00287,"kevAdded":null}]}