Openstack
Monthly
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). Exploit path is reachable against default configurations with no feature flag or non-default setting required, but it is not anonymously exploitable - a valid Mistral API token is the single prerequisite. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch availability is not confirmed in the provided data.
OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.
A server-side request forgery in the VMware datastore driver of OpenStack glance_store lets an authenticated OpenStack user supply a crafted image location URI pointing at an attacker-controlled server, causing the driver's _retry_request function to attach sensitive vCenter authentication headers to that outbound request and disclose them. The deployment must be configured with the non-default VMware/vCenter datastore backend, and the attacker needs an account with the ability to set or override image locations (typically gated behind the set_location / show_multiple_locations policy); SSVC rates the issue as Exploitation=poc with publicly available exploit code on GitHub (sadandbset/CVE-2026-51772-CVE-2026-51773), Technical Impact=total, but Automatable=no, so it is a targeted attack rather than a mass-exploitation candidate and there is no confirmed active exploitation (CISA KEV) at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects high confidentiality impact from credential theft; our independent assessment adjusts the integrity impact to Low because the primary outcome is leakage of authentication material rather than direct modification of data.
Authentication bypass in OpenStack Zaqar before 22.0.2 allows an unauthenticated remote attacker who knows a target project's UUID to send a request carrying an empty URL-Signature header and defeat both Keystone authentication and pre-signed URL verification, gaining the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. Only deployments using the WSGI transport with an authentication strategy configured are exposed; the websocket transport is explicitly not affected, and escalation to administrative operations such as managing pools and flavors additionally requires an admin_mode deployment in which the attacker asserts an administrative role. The issue is rated CVSS 4.0 base 9.2, while independent assessment scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with the AC:H component reflecting the prerequisite knowledge of the victim project UUID; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OpenStack project members can inject arbitrary HAProxy configuration directives - and from there achieve code execution on Amphora load-balancer instances - by embedding newline characters in the tls_ciphers field of a TLS-enabled listener or pool in OpenStack Octavia before 18.0.1. The value is written verbatim into the HAProxy configuration generated on the amphora, so a crafted cipher string breaks out of the intended directive and appends attacker-controlled configuration (CWE-94). Only deployments using the Amphora provider driver are affected; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact that extends beyond the vulnerable component to the amphora instance itself.
Authenticated OpenStack project members who own a load balancer can inject arbitrary HAProxy directives into the amphora configuration produced by Octavia before 18.0.1, because the Amphora provider driver fails to reject control characters in L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, so newline-bearing payloads pass structural checks, but the raw value is stored and written verbatim into the generated HAProxy config - yielding code/directive injection with high confidentiality, integrity, and availability impact on the amphora and the traffic it proxies. Exploitation requires valid tenant credentials plus ownership of a load balancer (CVSS PR:L, unauthenticated paths do not exist), and only Amphora-provider deployments are affected; OVN and other Octavia providers are explicitly immune. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the assessment rates it a genuine high-priority problem rather than an inflated score.
Missing object-level authorization in the OpenStack Blazar V2 lease API allows any authenticated user to modify or delete leases belonging to other users and projects if they know the target lease UUID. The defect affects Blazar releases before 17.0.1 and arises because the oslo.policy authorize() wrapper resolves the wrong request parameter, so the ownership check silently degrades into comparing the requester against their own project_id and user_id and therefore always passes. No public exploit code has been identified at time of analysis, and exploitation requires a valid cloud credential plus a deployment that actually runs the optional reservation service, but the integrity and availability impact on lease objects is high because reservations underpin the scheduled resource allocations of other tenants.
An authenticated user with access to the OpenStack Blazar V2 REST API can enumerate leases belonging to other projects in Blazar versions before 17.0.1, because the GET /v2/leases endpoint enforces neither project scoping nor an administrator-only policy. This broken access control (CWE-862) exposes lease IDs, reservation IDs, resource IDs, and reservation metadata; the leaked lease IDs can then be leveraged with a separate object-level authorization bypass to modify or delete those leases. The flaw requires valid Blazar credentials and a deployment running the optional Blazar reservation service, and no public exploit identified at time of analysis.
Incorrect authorization in OpenStack Keystone before 29.0.3 allows holders of delegated authentication tokens (EC2 credentials, application credentials, OAuth1 access tokens, or trusts) to create, modify, or delete credentials via the /v3/credentials API without restriction. EC2-derived tokens can additionally read raw credential blobs, exposing TOTP MFA seeds and other secrets stored in Keystone. An additional authorization gap in PATCH /v3/credentials permits any delegated token to reassign a credential to an arbitrary project, bypassing project-isolation controls. No public exploit code or CISA KEV listing identified at time of analysis.
OpenStack Keystone before 29.0.3 allows any authenticated user holding role:reader on any project to enumerate all role assignments across any domain in the cloud by exploiting a type-confusion bug in the GET /v3/role_assignments endpoint. The attack supplies a domain ID as scope.project.id with include_subtree, triggering a null domain_id policy check that passes unconditionally for all callers because domains are internally modeled as projects with domain_id=null. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role across the targeted domain - and the well-known 'default' domain constant works against every deployment bootstrapped with keystone-manage bootstrap, requiring no prior reconnaissance. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exhaust all proxy worker threads with a trivially crafted HTTP Accept header. The proxy server's Accept header parser employs a qdtext regex pattern susceptible to catastrophic backtracking (CWE-1333), where a payload of just 32 backslash-character pairs stalls a single worker for over 30 seconds. Repeated concurrent requests consume all available proxy workers, causing complete and sustained service unavailability — no authentication, session, or account is required. No public exploit or CISA KEV listing has been identified at time of analysis, though the description itself constitutes a functional attack recipe.
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Resource-accounting bypass in OpenStack Nova (compute service) lets an authenticated tenant create an instance whose scheduler hint data is not properly stripped, resulting in a running VM that has no corresponding Placement allocation. Because the instance consumes real host CPU/RAM/disk that the Placement service never accounted for, an attacker with ordinary project credentials can quietly over-subscribe a compute host and degrade availability for co-located tenants. SSVC lists exploitation as proof-of-concept (no public exploit identified as weaponized) with partial technical impact; EPSS is low at 0.26% (17th percentile).
Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows remote unauthenticated attackers to crash the bare-metal provisioning service by submitting a crafted JSON payload to certain API or JSON-RPC endpoints. CVSS 7.5 reflects high availability impact with no authentication required, though EPSS is only 0.04% (12th percentile) and SSVC marks exploitation as 'none' - no public exploit identified at time of analysis. The flaw is tracked as a CWE-770 unbounded resource consumption issue and documented in OpenStack Security Note OSSN-0099.
Arbitrary file overwrite in OpenStack Ironic (bare-metal provisioning service) lets an authenticated tenant supply a crafted ISO image whose internal paths use directory-traversal sequences, causing files to be written outside the intended deployment directory on the Ironic host during provisioning. Multiple release branches are affected up to 35.0.2, 32.0.2, 29.0.6, and 26.1.7, and a vendor patch is available. No public exploit has been identified at time of analysis, and EPSS is low (0.23%), consistent with the CISA SSVC assessment of no known exploitation.
Boot script injection in OpenStack Ironic versions up to and including 35.0.x allows authenticated tenants to influence boot scripts processed by the bare-metal provisioning service, with integrity impact extending across a CVSS scope change to the provisioned hardware. Confirmed by upstream advisory OSSA-2026-017 and an Ubuntu USN, with no public exploit identified at time of analysis and an EPSS of 0.03% indicating no observed exploitation activity.
Privilege escalation in OpenStack Keystone before 29.0.2 lets a user holding only the member role on a project chain unrestricted application credentials with Keystone trusts to obtain admin. Because Keystone validates delegated roles against the victim's actual database role assignments rather than the roles on the requesting token, an attacker who can impersonate a victim's token can mint a trust delegating the victim's admin role to themselves, with all activity logged under the victim's identity. Exploitation is only practical when paired with a separate application-credential impersonation flaw; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Authorization bypass in OpenStack Keystone before 29.0.2 lets any authenticated user override trusted RBAC policy targets by injecting attributes like user_id or project_id into the JSON request body. The enforce_call routine unconditionally merges the raw request body over database-derived target data, so low-privileged users can perform operations on resources owned by other users or projects. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the flaw is trivially exploitable by any account and a vendor patch is available.
Denial of service in OpenStack Swift's s3api middleware allows an authenticated S3 API user to permanently hang proxy-server workers by sending a truncated aws-chunked PUT request body. Versions 2.36.0 through 2.36.1 and 2.37.0 through 2.37.1 are affected; the defect was introduced in 2.36.0 and fixed in 2.36.2 and 2.37.2. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), but the high availability impact and low attack complexity make this a credible operational threat to S3-compatible Swift deployments.
Credential forwarding vulnerability in OpenStack Ironic's idrac driver allows authenticated attackers to steal time-limited Keystone tokens or molds storage credentials by manipulating import operations. Attackers with low-privileged Ironic access can redirect these credentials to attacker-controlled endpoints, gaining unauthorized access to all OpenStack services that Ironic is authorized for. Fixed in versions 26.1.6, 29.0.5, 32.0.1, and 35.0.1. CVSS 7.7 with scope change (S:C) reflects the privilege escalation from Ironic-only access to full OpenStack service access.
Arbitrary code execution in OpenStack ironic-python-agent (IPA) versions 1.0.0 through 11.5.0 occurs because IPA runs grub-install from inside a chroot of the partition image it is deploying, so binaries supplied by a malicious image execute on the provisioning ramdisk. An attacker able to have a crafted partition image deployed can run code in the IPA context (typically root on the bare-metal node being provisioned). No public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records exploitation status as none, but the technical impact is rated total.
Cross-project privilege escalation in OpenStack Keystone (releases 13 through 29) lets a holder of an unrestricted application credential for one project mint an EC2-type credential targeting a different project, because POST /v3/credentials never validates that the caller-supplied project_id matches the authenticating app credential's project. Exchanging that EC2 credential at /v3/ec2tokens then yields a Keystone token scoped to the second project while retaining the original app_cred_id, enabling lateral movement across tenants. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the authorization flaw (CWE-863) is confirmed and patched by upstream and distributors.
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through crafted queries. Affects versions before 12.0.1, 13.0.0, 14.0.0, and 15.0.0. PoC available.
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 60.9%.
An authenticated tenant (PR:L) can abuse OpenStack Mistral's workflow membership API to grant a third project read and execution access to another project's private workflow without the owner's consent. Exploitation requires an existing, already-accepted share of the target workflow plus a third project under the attacker's control or collusion to accept the forged membership, which causes the new membership row to be written with the accepting project's ID instead of the original owner's - leaving the owner unable to see or revoke it. The result is a multi-tenant authorization bypass (CWE-863) confined to confidentiality and execution of the specifically shared workflow; no public exploit code has been identified at time of analysis. Per the independent assessment this is a genuine but moderate-priority flaw, not a high-severity issue, and it only affects multi-tenant deployments that actively use Mistral workflow sharing.
Cross-project queue access in OpenStack Zaqar's WebSocket transport lets an authenticated user who holds a valid Keystone token for one project substitute a different project's UUID in subsequent requests, then enumerate, inspect, create, or delete queues belonging to that other tenant. Only deployments that deliberately enable the WebSocket transport together with Keystone authentication are exposed; the more widely used REST transport and non-Keystone setups are explicitly out of scope. Publicly available exploit code exists (SSVC exploitation: poc), the vendor has released a fix in 23.0.1, and the assessed impact is low confidentiality but high integrity and availability loss within the targeted project.
Information disclosure in OpenStack Swift deployments that run the shipped default proxy pipeline: the tempurl middleware does not reject an attacker-supplied X-Copy-From header on signed PUT requests, so anyone holding a valid, unexpired PUT TempURL for a single object can make the copy middleware pull another object from the same account into the destination path and then read that data back using a GET TempURL for the destination. The impact is bounded rather than systemic - copies across account boundaries are rejected, deployments without the copy middleware in the pipeline are unaffected, and the CVSS score is 5.3 with a PR:L vector reflecting the need to hold a legitimate signed TempURL capability. No public exploit code has been identified at time of analysis, and CVE-2026-97149 is not reported as confirmed actively exploited (CISA KEV).
Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-tenant information disclosure in OpenStack Ironic before 38.0.1 exposes residual disk contents from prior bare metal node occupants when the autodetect deploy interface is used. The bug causes the mandatory cleaning step to be skipped immediately after a node is enrolled with, or transitioned to, the autodetect deploy interface, meaning a newly allocated tenant may receive a node whose storage has not been wiped. The CVSS scope-change metric (S:C, C:H) reflects the multi-tenant nature of the impact: one authenticated user's data persists onto a node now accessible to a different principal. No public exploit has been identified at time of analysis.
QoS policy authorization bypass in OpenStack Octavia through version 18.0.0 permits authenticated tenant users to associate another project's Quality of Service policy with an amphora they control, blocking the legitimate policy owner from deleting that resource. The vendor confirms all Octavia deployments are affected, making this a universal tenant-isolation concern for multi-tenant OpenStack clouds. No active exploitation or public exploit code has been identified at time of analysis; the CVSS 4.3 Medium score reflects limited impact scope - integrity only, with no confidentiality or availability exposure.
Denial-of-service in OpenStack Designate's mDNS handler allows unauthenticated remote disruption of DNS resolution across all tenants sharing an affected pool path. The handler performs pool-blind zone lookups: when two zones with the same name exist across different pools - a condition reachable either through a separate cross-tenant zone overlap vulnerability or via legitimate cross-pool configurations - the lookup fails deterministically, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify trigger is reachable via a single unauthenticated UDP packet, with no public exploit code identified at time of analysis and no confirmed active exploitation in the CISA KEV catalog.
Incorrect authorization in OpenStack Ironic through 38.0.0 allows an authenticated low-privilege project reader to leak Portgroup configuration data belonging to Nodes owned or leased by other tenants via a crafted API request. The flaw breaks multi-tenant isolation - a core security guarantee of shared cloud infrastructure - enabling cross-project enumeration of bare-metal network topology. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and wide affected version range (spanning multiple major release series) make this a meaningful risk for multi-tenant OpenStack deployments.
Cross-tenant object exfiltration in OpenStack Swift through 2.38.0 allows authenticated S3 API users to bypass source-object authorization by injecting Swift-native server-side copy headers (X-Copy-From, X-Copy-From-Account) into a signed S3 PUT request. The S3API middleware authorizes the request against the attacker-controlled destination bucket and then forwards the copy headers to Swift's copy engine, which executes the cross-tenant copy without re-evaluating the source object's ACLs or ownership - a classic confused-deputy flaw (CWE-863). Exploitation is constrained to deployments with the non-default s3_acl=true option enabled, and no public exploit is identified at time of analysis.
OpenStack Swift's S3API middleware through version 2.38.0 fails to enforce SigV4 signature coverage over semantic x-amz-* headers on presigned URL requests, enabling unauthorized server-side object copy operations under the signer's authorization context. An attacker holding a valid presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, redirecting Swift's behavior from a client upload into a server-side copy that reads any object accessible to the URL's original signer - effectively allowing privilege escalation within a delegated authorization context. No public exploit or CISA KEV listing was identified at time of analysis, but all deployments running the S3API middleware under the default s3_acl=false configuration are affected.
Authentication bypass in OpenStack Zaqar through version 22.0.0 allows network-reachable attackers without credentials to circumvent access controls by supplying a crafted EXTRA-SPEC HTTP header paired with a known queue UUID. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning the service fails to enforce credential validation on certain request paths when this header is present. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-accessible nature of Zaqar's REST API makes this a meaningful risk for deployments where queue UUIDs may be discoverable through logs or enumeration.
Server-side request forgery in OpenStack Swift's proxy-server allows authenticated users to manipulate object servers into issuing outbound HTTP requests to attacker-specified hosts. All Swift deployments running version 2.0.0 or later across all maintained release trains are affected, including the 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and development 2026.2/hibiscus branches. No public exploit has been identified at time of analysis, but successful exploitation could expose internal infrastructure topology, metadata services, or other resources reachable from the object server tier.
OpenStack Horizon before 25.7.4 embeds project names unsanitized into generated OpenStack RC shell scripts, enabling OS command injection when a victim user downloads and sources that script locally. An attacker with sufficient privileges to create or control a project name can insert shell metacharacters (e.g., backtick sequences, command substitution syntax) that execute arbitrary commands in the victim's local shell environment upon RC file execution. No public exploit code or CISA KEV listing exists at time of analysis, though the underlying CWE-78 class is well-understood; notably, the OpenStack project itself characterizes this as a security hardening opportunity rather than a traditional vulnerability, reflecting a disputed severity framing.
Unredacted iSCSI credential disclosure in OpenStack Ironic through 35.0.1 occurs specifically when an authenticated operator issues a PATCH request to update authorized fields in a node's volume properties - the API response returns sensitive data such as iSCSI CHAP usernames and secrets in plaintext. The scope change reflected in the CVSS (S:C) is meaningful: leaked storage credentials extend the blast radius beyond Ironic itself to the underlying iSCSI storage infrastructure. Notably, the same volume properties endpoint does not exhibit this behavior on POST requests, isolating the flaw to the PATCH response serialization path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Incorrect RBAC policy in OpenStack Neutron before 28.0.1 allows an authenticated project manager to set device_owner on ports of shared networks they do not own to privileged network-service values (e.g., 'network:dhcp'), obtaining trusted network-service port behavior without owning the underlying network. Depending on backend and deployment configuration, this enables DHCP, MAC, or IP spoofing against co-tenants sharing that network, effectively bypassing anti-spoofing and security group protections. This is a confirmed regression of CVE-2015-5240 (OSSA-2015-018); no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
File extraction from the Ironic conductor service is possible via a crafted pxe_template, as disclosed in OpenStack Security Advisory OSSA-2026-019. The Ironic conductor is a privileged management component that coordinates bare metal node provisioning; arbitrary file read from this host could expose infrastructure credentials, TLS keys, or cloud configuration secrets. No public exploit has been identified at time of analysis, and no CVSS score has been assigned, but the severity is elevated by the conductor's privileged position in OpenStack infrastructure.
User impersonation in OpenStack Keystone before 29.0.2 allows an authenticated attacker to obtain a valid Keystone token attributed to an arbitrary victim user by exploiting a missing ownership check in the application credential authentication plugin. The attacker supplies their own application credential ID and secret while embedding a different user's name and domain in the request body, and Keystone issues a project-scoped token carrying the intersection of the attacker's application credential roles and the victim's project roles. This enables audit log evasion, exposure of the victim's credentials, and unauthorized action within shared OpenStack projects. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
OpenStack Keystone's federated token rescoping mechanism allows authenticated federated users to indefinitely extend their session beyond operator-configured token lifetime policies by repeatedly calling POST /v3/auth/tokens before each token expires. The root cause is that handle_scoped_token() in the mapped authentication plugin omits the expires_at field from its response, causing the token provider to silently issue a fresh default-TTL token instead of inheriting the original token's expiry. This effectively renders token lifetime enforcement inoperative for all SAML2 and OpenID Connect-backed federated deployments running Keystone versions prior to 29.0.2. No public exploit code exists and this is not listed in CISA KEV, but the technique is trivially repeatable by any valid federated user.
Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to exhaust conductor resources by supplying file:///dev/zero as an image URL, triggering unbounded checksum calculations that never terminate. All Ironic versions from 0 through 35.x prior to commit a3f6d73 are affected. No public exploit independently confirmed but SSVC data indicates proof-of-concept exists; EPSS sits at 0.01% (2nd percentile), consistent with low widespread exploitation likelihood despite the poc signal.
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose sensitive information by rendering unsandboxed Jinja2 templates in the instance_info['ks_template'] parameter. The vulnerability requires high-privilege user interaction and has low confidentiality impact with no integrity or availability consequences.
OpenStack Horizon 25.6 and 25.7 before 25.7.3 allows unauthenticated remote attackers to exhaust session storage backend resources through repeated requests that trigger write operations prior to authentication, causing denial of service. This is a regression of CVE-2014-8124 and is assigned CVSS 5.3 (network-based, low complexity, no authentication required).
DOM-based cross-site scripting in OpenStack Skyline console interface allows authenticated administrators to execute arbitrary JavaScript via unsafe document.write usage when viewing instance console logs. Affects Skyline versions before 5.0.1, 6.0.0, and 7.0.0. Attack requires administrator authentication and user interaction (UI:R), limiting real-world impact but enabling session hijacking or credential theft from privileged users.
OpenStack Keystone 14 through 29.x allows authenticated users with restricted application credentials to create EC2 credentials that inherit the parent user's full S3 permissions, bypassing role restrictions. This privilege escalation affects only deployments combining restricted application credentials with the EC2/S3 compatibility API (swift3/s3api), and requires valid authentication credentials and moderate attack complexity to exploit.
Server-Side Request Forgery in OpenStack Glance image import allows authenticated users to bypass URL validation via HTTP redirects and reach internal services. Affected versions include Glance prior to 29.1.1, 30.0.0 through 30.1.0, and 31.0.0. The vulnerability impacts web-download and glance-download import methods, plus the optional ovf_process plugin. An authenticated attacker can craft a redirect chain to access restricted internal endpoints, though the CVSS vector indicates no confidentiality impact and limited integrity risk (CVSS 5.0). No public exploit code or active exploitation has been confirmed at time of analysis.
An incomplete fix for CVE-2023-1625 was found in openstack-heat. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in python-glance-store. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in OpenStack Barbican containers. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A credentials leak flaw was found in OpenStack Barbican. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An information leak was discovered in OpenStack heat. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
An authorization flaw was found in openstack-barbican. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
A flaw was found in Keystone. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
A flaw was found in python-oslo-utils. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. Rated medium severity (CVSS 5.0).
An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Apache HTTP Server versions 2.4.20 to 2.4.43. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). Exploit path is reachable against default configurations with no feature flag or non-default setting required, but it is not anonymously exploitable - a valid Mistral API token is the single prerequisite. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch availability is not confirmed in the provided data.
OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.
A server-side request forgery in the VMware datastore driver of OpenStack glance_store lets an authenticated OpenStack user supply a crafted image location URI pointing at an attacker-controlled server, causing the driver's _retry_request function to attach sensitive vCenter authentication headers to that outbound request and disclose them. The deployment must be configured with the non-default VMware/vCenter datastore backend, and the attacker needs an account with the ability to set or override image locations (typically gated behind the set_location / show_multiple_locations policy); SSVC rates the issue as Exploitation=poc with publicly available exploit code on GitHub (sadandbset/CVE-2026-51772-CVE-2026-51773), Technical Impact=total, but Automatable=no, so it is a targeted attack rather than a mass-exploitation candidate and there is no confirmed active exploitation (CISA KEV) at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects high confidentiality impact from credential theft; our independent assessment adjusts the integrity impact to Low because the primary outcome is leakage of authentication material rather than direct modification of data.
Authentication bypass in OpenStack Zaqar before 22.0.2 allows an unauthenticated remote attacker who knows a target project's UUID to send a request carrying an empty URL-Signature header and defeat both Keystone authentication and pre-signed URL verification, gaining the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. Only deployments using the WSGI transport with an authentication strategy configured are exposed; the websocket transport is explicitly not affected, and escalation to administrative operations such as managing pools and flavors additionally requires an admin_mode deployment in which the attacker asserts an administrative role. The issue is rated CVSS 4.0 base 9.2, while independent assessment scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with the AC:H component reflecting the prerequisite knowledge of the victim project UUID; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OpenStack project members can inject arbitrary HAProxy configuration directives - and from there achieve code execution on Amphora load-balancer instances - by embedding newline characters in the tls_ciphers field of a TLS-enabled listener or pool in OpenStack Octavia before 18.0.1. The value is written verbatim into the HAProxy configuration generated on the amphora, so a crafted cipher string breaks out of the intended directive and appends attacker-controlled configuration (CWE-94). Only deployments using the Amphora provider driver are affected; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact that extends beyond the vulnerable component to the amphora instance itself.
Authenticated OpenStack project members who own a load balancer can inject arbitrary HAProxy directives into the amphora configuration produced by Octavia before 18.0.1, because the Amphora provider driver fails to reject control characters in L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, so newline-bearing payloads pass structural checks, but the raw value is stored and written verbatim into the generated HAProxy config - yielding code/directive injection with high confidentiality, integrity, and availability impact on the amphora and the traffic it proxies. Exploitation requires valid tenant credentials plus ownership of a load balancer (CVSS PR:L, unauthenticated paths do not exist), and only Amphora-provider deployments are affected; OVN and other Octavia providers are explicitly immune. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the assessment rates it a genuine high-priority problem rather than an inflated score.
Missing object-level authorization in the OpenStack Blazar V2 lease API allows any authenticated user to modify or delete leases belonging to other users and projects if they know the target lease UUID. The defect affects Blazar releases before 17.0.1 and arises because the oslo.policy authorize() wrapper resolves the wrong request parameter, so the ownership check silently degrades into comparing the requester against their own project_id and user_id and therefore always passes. No public exploit code has been identified at time of analysis, and exploitation requires a valid cloud credential plus a deployment that actually runs the optional reservation service, but the integrity and availability impact on lease objects is high because reservations underpin the scheduled resource allocations of other tenants.
An authenticated user with access to the OpenStack Blazar V2 REST API can enumerate leases belonging to other projects in Blazar versions before 17.0.1, because the GET /v2/leases endpoint enforces neither project scoping nor an administrator-only policy. This broken access control (CWE-862) exposes lease IDs, reservation IDs, resource IDs, and reservation metadata; the leaked lease IDs can then be leveraged with a separate object-level authorization bypass to modify or delete those leases. The flaw requires valid Blazar credentials and a deployment running the optional Blazar reservation service, and no public exploit identified at time of analysis.
Incorrect authorization in OpenStack Keystone before 29.0.3 allows holders of delegated authentication tokens (EC2 credentials, application credentials, OAuth1 access tokens, or trusts) to create, modify, or delete credentials via the /v3/credentials API without restriction. EC2-derived tokens can additionally read raw credential blobs, exposing TOTP MFA seeds and other secrets stored in Keystone. An additional authorization gap in PATCH /v3/credentials permits any delegated token to reassign a credential to an arbitrary project, bypassing project-isolation controls. No public exploit code or CISA KEV listing identified at time of analysis.
OpenStack Keystone before 29.0.3 allows any authenticated user holding role:reader on any project to enumerate all role assignments across any domain in the cloud by exploiting a type-confusion bug in the GET /v3/role_assignments endpoint. The attack supplies a domain ID as scope.project.id with include_subtree, triggering a null domain_id policy check that passes unconditionally for all callers because domains are internally modeled as projects with domain_id=null. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role across the targeted domain - and the well-known 'default' domain constant works against every deployment bootstrapped with keystone-manage bootstrap, requiring no prior reconnaissance. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exhaust all proxy worker threads with a trivially crafted HTTP Accept header. The proxy server's Accept header parser employs a qdtext regex pattern susceptible to catastrophic backtracking (CWE-1333), where a payload of just 32 backslash-character pairs stalls a single worker for over 30 seconds. Repeated concurrent requests consume all available proxy workers, causing complete and sustained service unavailability — no authentication, session, or account is required. No public exploit or CISA KEV listing has been identified at time of analysis, though the description itself constitutes a functional attack recipe.
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Resource-accounting bypass in OpenStack Nova (compute service) lets an authenticated tenant create an instance whose scheduler hint data is not properly stripped, resulting in a running VM that has no corresponding Placement allocation. Because the instance consumes real host CPU/RAM/disk that the Placement service never accounted for, an attacker with ordinary project credentials can quietly over-subscribe a compute host and degrade availability for co-located tenants. SSVC lists exploitation as proof-of-concept (no public exploit identified as weaponized) with partial technical impact; EPSS is low at 0.26% (17th percentile).
Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows remote unauthenticated attackers to crash the bare-metal provisioning service by submitting a crafted JSON payload to certain API or JSON-RPC endpoints. CVSS 7.5 reflects high availability impact with no authentication required, though EPSS is only 0.04% (12th percentile) and SSVC marks exploitation as 'none' - no public exploit identified at time of analysis. The flaw is tracked as a CWE-770 unbounded resource consumption issue and documented in OpenStack Security Note OSSN-0099.
Arbitrary file overwrite in OpenStack Ironic (bare-metal provisioning service) lets an authenticated tenant supply a crafted ISO image whose internal paths use directory-traversal sequences, causing files to be written outside the intended deployment directory on the Ironic host during provisioning. Multiple release branches are affected up to 35.0.2, 32.0.2, 29.0.6, and 26.1.7, and a vendor patch is available. No public exploit has been identified at time of analysis, and EPSS is low (0.23%), consistent with the CISA SSVC assessment of no known exploitation.
Boot script injection in OpenStack Ironic versions up to and including 35.0.x allows authenticated tenants to influence boot scripts processed by the bare-metal provisioning service, with integrity impact extending across a CVSS scope change to the provisioned hardware. Confirmed by upstream advisory OSSA-2026-017 and an Ubuntu USN, with no public exploit identified at time of analysis and an EPSS of 0.03% indicating no observed exploitation activity.
Privilege escalation in OpenStack Keystone before 29.0.2 lets a user holding only the member role on a project chain unrestricted application credentials with Keystone trusts to obtain admin. Because Keystone validates delegated roles against the victim's actual database role assignments rather than the roles on the requesting token, an attacker who can impersonate a victim's token can mint a trust delegating the victim's admin role to themselves, with all activity logged under the victim's identity. Exploitation is only practical when paired with a separate application-credential impersonation flaw; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Authorization bypass in OpenStack Keystone before 29.0.2 lets any authenticated user override trusted RBAC policy targets by injecting attributes like user_id or project_id into the JSON request body. The enforce_call routine unconditionally merges the raw request body over database-derived target data, so low-privileged users can perform operations on resources owned by other users or projects. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the flaw is trivially exploitable by any account and a vendor patch is available.
Denial of service in OpenStack Swift's s3api middleware allows an authenticated S3 API user to permanently hang proxy-server workers by sending a truncated aws-chunked PUT request body. Versions 2.36.0 through 2.36.1 and 2.37.0 through 2.37.1 are affected; the defect was introduced in 2.36.0 and fixed in 2.36.2 and 2.37.2. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), but the high availability impact and low attack complexity make this a credible operational threat to S3-compatible Swift deployments.
Credential forwarding vulnerability in OpenStack Ironic's idrac driver allows authenticated attackers to steal time-limited Keystone tokens or molds storage credentials by manipulating import operations. Attackers with low-privileged Ironic access can redirect these credentials to attacker-controlled endpoints, gaining unauthorized access to all OpenStack services that Ironic is authorized for. Fixed in versions 26.1.6, 29.0.5, 32.0.1, and 35.0.1. CVSS 7.7 with scope change (S:C) reflects the privilege escalation from Ironic-only access to full OpenStack service access.
Arbitrary code execution in OpenStack ironic-python-agent (IPA) versions 1.0.0 through 11.5.0 occurs because IPA runs grub-install from inside a chroot of the partition image it is deploying, so binaries supplied by a malicious image execute on the provisioning ramdisk. An attacker able to have a crafted partition image deployed can run code in the IPA context (typically root on the bare-metal node being provisioned). No public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records exploitation status as none, but the technical impact is rated total.
Cross-project privilege escalation in OpenStack Keystone (releases 13 through 29) lets a holder of an unrestricted application credential for one project mint an EC2-type credential targeting a different project, because POST /v3/credentials never validates that the caller-supplied project_id matches the authenticating app credential's project. Exchanging that EC2 credential at /v3/ec2tokens then yields a Keystone token scoped to the second project while retaining the original app_cred_id, enabling lateral movement across tenants. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the authorization flaw (CWE-863) is confirmed and patched by upstream and distributors.
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through crafted queries. Affects versions before 12.0.1, 13.0.0, 14.0.0, and 15.0.0. PoC available.
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 60.9%.
An authenticated tenant (PR:L) can abuse OpenStack Mistral's workflow membership API to grant a third project read and execution access to another project's private workflow without the owner's consent. Exploitation requires an existing, already-accepted share of the target workflow plus a third project under the attacker's control or collusion to accept the forged membership, which causes the new membership row to be written with the accepting project's ID instead of the original owner's - leaving the owner unable to see or revoke it. The result is a multi-tenant authorization bypass (CWE-863) confined to confidentiality and execution of the specifically shared workflow; no public exploit code has been identified at time of analysis. Per the independent assessment this is a genuine but moderate-priority flaw, not a high-severity issue, and it only affects multi-tenant deployments that actively use Mistral workflow sharing.
Cross-project queue access in OpenStack Zaqar's WebSocket transport lets an authenticated user who holds a valid Keystone token for one project substitute a different project's UUID in subsequent requests, then enumerate, inspect, create, or delete queues belonging to that other tenant. Only deployments that deliberately enable the WebSocket transport together with Keystone authentication are exposed; the more widely used REST transport and non-Keystone setups are explicitly out of scope. Publicly available exploit code exists (SSVC exploitation: poc), the vendor has released a fix in 23.0.1, and the assessed impact is low confidentiality but high integrity and availability loss within the targeted project.
Information disclosure in OpenStack Swift deployments that run the shipped default proxy pipeline: the tempurl middleware does not reject an attacker-supplied X-Copy-From header on signed PUT requests, so anyone holding a valid, unexpired PUT TempURL for a single object can make the copy middleware pull another object from the same account into the destination path and then read that data back using a GET TempURL for the destination. The impact is bounded rather than systemic - copies across account boundaries are rejected, deployments without the copy middleware in the pipeline are unaffected, and the CVSS score is 5.3 with a PR:L vector reflecting the need to hold a legitimate signed TempURL capability. No public exploit code has been identified at time of analysis, and CVE-2026-97149 is not reported as confirmed actively exploited (CISA KEV).
Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-tenant information disclosure in OpenStack Ironic before 38.0.1 exposes residual disk contents from prior bare metal node occupants when the autodetect deploy interface is used. The bug causes the mandatory cleaning step to be skipped immediately after a node is enrolled with, or transitioned to, the autodetect deploy interface, meaning a newly allocated tenant may receive a node whose storage has not been wiped. The CVSS scope-change metric (S:C, C:H) reflects the multi-tenant nature of the impact: one authenticated user's data persists onto a node now accessible to a different principal. No public exploit has been identified at time of analysis.
QoS policy authorization bypass in OpenStack Octavia through version 18.0.0 permits authenticated tenant users to associate another project's Quality of Service policy with an amphora they control, blocking the legitimate policy owner from deleting that resource. The vendor confirms all Octavia deployments are affected, making this a universal tenant-isolation concern for multi-tenant OpenStack clouds. No active exploitation or public exploit code has been identified at time of analysis; the CVSS 4.3 Medium score reflects limited impact scope - integrity only, with no confidentiality or availability exposure.
Denial-of-service in OpenStack Designate's mDNS handler allows unauthenticated remote disruption of DNS resolution across all tenants sharing an affected pool path. The handler performs pool-blind zone lookups: when two zones with the same name exist across different pools - a condition reachable either through a separate cross-tenant zone overlap vulnerability or via legitimate cross-pool configurations - the lookup fails deterministically, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify trigger is reachable via a single unauthenticated UDP packet, with no public exploit code identified at time of analysis and no confirmed active exploitation in the CISA KEV catalog.
Incorrect authorization in OpenStack Ironic through 38.0.0 allows an authenticated low-privilege project reader to leak Portgroup configuration data belonging to Nodes owned or leased by other tenants via a crafted API request. The flaw breaks multi-tenant isolation - a core security guarantee of shared cloud infrastructure - enabling cross-project enumeration of bare-metal network topology. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and wide affected version range (spanning multiple major release series) make this a meaningful risk for multi-tenant OpenStack deployments.
Cross-tenant object exfiltration in OpenStack Swift through 2.38.0 allows authenticated S3 API users to bypass source-object authorization by injecting Swift-native server-side copy headers (X-Copy-From, X-Copy-From-Account) into a signed S3 PUT request. The S3API middleware authorizes the request against the attacker-controlled destination bucket and then forwards the copy headers to Swift's copy engine, which executes the cross-tenant copy without re-evaluating the source object's ACLs or ownership - a classic confused-deputy flaw (CWE-863). Exploitation is constrained to deployments with the non-default s3_acl=true option enabled, and no public exploit is identified at time of analysis.
OpenStack Swift's S3API middleware through version 2.38.0 fails to enforce SigV4 signature coverage over semantic x-amz-* headers on presigned URL requests, enabling unauthorized server-side object copy operations under the signer's authorization context. An attacker holding a valid presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, redirecting Swift's behavior from a client upload into a server-side copy that reads any object accessible to the URL's original signer - effectively allowing privilege escalation within a delegated authorization context. No public exploit or CISA KEV listing was identified at time of analysis, but all deployments running the S3API middleware under the default s3_acl=false configuration are affected.
Authentication bypass in OpenStack Zaqar through version 22.0.0 allows network-reachable attackers without credentials to circumvent access controls by supplying a crafted EXTRA-SPEC HTTP header paired with a known queue UUID. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning the service fails to enforce credential validation on certain request paths when this header is present. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-accessible nature of Zaqar's REST API makes this a meaningful risk for deployments where queue UUIDs may be discoverable through logs or enumeration.
Server-side request forgery in OpenStack Swift's proxy-server allows authenticated users to manipulate object servers into issuing outbound HTTP requests to attacker-specified hosts. All Swift deployments running version 2.0.0 or later across all maintained release trains are affected, including the 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and development 2026.2/hibiscus branches. No public exploit has been identified at time of analysis, but successful exploitation could expose internal infrastructure topology, metadata services, or other resources reachable from the object server tier.
OpenStack Horizon before 25.7.4 embeds project names unsanitized into generated OpenStack RC shell scripts, enabling OS command injection when a victim user downloads and sources that script locally. An attacker with sufficient privileges to create or control a project name can insert shell metacharacters (e.g., backtick sequences, command substitution syntax) that execute arbitrary commands in the victim's local shell environment upon RC file execution. No public exploit code or CISA KEV listing exists at time of analysis, though the underlying CWE-78 class is well-understood; notably, the OpenStack project itself characterizes this as a security hardening opportunity rather than a traditional vulnerability, reflecting a disputed severity framing.
Unredacted iSCSI credential disclosure in OpenStack Ironic through 35.0.1 occurs specifically when an authenticated operator issues a PATCH request to update authorized fields in a node's volume properties - the API response returns sensitive data such as iSCSI CHAP usernames and secrets in plaintext. The scope change reflected in the CVSS (S:C) is meaningful: leaked storage credentials extend the blast radius beyond Ironic itself to the underlying iSCSI storage infrastructure. Notably, the same volume properties endpoint does not exhibit this behavior on POST requests, isolating the flaw to the PATCH response serialization path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Incorrect RBAC policy in OpenStack Neutron before 28.0.1 allows an authenticated project manager to set device_owner on ports of shared networks they do not own to privileged network-service values (e.g., 'network:dhcp'), obtaining trusted network-service port behavior without owning the underlying network. Depending on backend and deployment configuration, this enables DHCP, MAC, or IP spoofing against co-tenants sharing that network, effectively bypassing anti-spoofing and security group protections. This is a confirmed regression of CVE-2015-5240 (OSSA-2015-018); no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
File extraction from the Ironic conductor service is possible via a crafted pxe_template, as disclosed in OpenStack Security Advisory OSSA-2026-019. The Ironic conductor is a privileged management component that coordinates bare metal node provisioning; arbitrary file read from this host could expose infrastructure credentials, TLS keys, or cloud configuration secrets. No public exploit has been identified at time of analysis, and no CVSS score has been assigned, but the severity is elevated by the conductor's privileged position in OpenStack infrastructure.
User impersonation in OpenStack Keystone before 29.0.2 allows an authenticated attacker to obtain a valid Keystone token attributed to an arbitrary victim user by exploiting a missing ownership check in the application credential authentication plugin. The attacker supplies their own application credential ID and secret while embedding a different user's name and domain in the request body, and Keystone issues a project-scoped token carrying the intersection of the attacker's application credential roles and the victim's project roles. This enables audit log evasion, exposure of the victim's credentials, and unauthorized action within shared OpenStack projects. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
OpenStack Keystone's federated token rescoping mechanism allows authenticated federated users to indefinitely extend their session beyond operator-configured token lifetime policies by repeatedly calling POST /v3/auth/tokens before each token expires. The root cause is that handle_scoped_token() in the mapped authentication plugin omits the expires_at field from its response, causing the token provider to silently issue a fresh default-TTL token instead of inheriting the original token's expiry. This effectively renders token lifetime enforcement inoperative for all SAML2 and OpenID Connect-backed federated deployments running Keystone versions prior to 29.0.2. No public exploit code exists and this is not listed in CISA KEV, but the technique is trivially repeatable by any valid federated user.
Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to exhaust conductor resources by supplying file:///dev/zero as an image URL, triggering unbounded checksum calculations that never terminate. All Ironic versions from 0 through 35.x prior to commit a3f6d73 are affected. No public exploit independently confirmed but SSVC data indicates proof-of-concept exists; EPSS sits at 0.01% (2nd percentile), consistent with low widespread exploitation likelihood despite the poc signal.
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose sensitive information by rendering unsandboxed Jinja2 templates in the instance_info['ks_template'] parameter. The vulnerability requires high-privilege user interaction and has low confidentiality impact with no integrity or availability consequences.
OpenStack Horizon 25.6 and 25.7 before 25.7.3 allows unauthenticated remote attackers to exhaust session storage backend resources through repeated requests that trigger write operations prior to authentication, causing denial of service. This is a regression of CVE-2014-8124 and is assigned CVSS 5.3 (network-based, low complexity, no authentication required).
DOM-based cross-site scripting in OpenStack Skyline console interface allows authenticated administrators to execute arbitrary JavaScript via unsafe document.write usage when viewing instance console logs. Affects Skyline versions before 5.0.1, 6.0.0, and 7.0.0. Attack requires administrator authentication and user interaction (UI:R), limiting real-world impact but enabling session hijacking or credential theft from privileged users.
OpenStack Keystone 14 through 29.x allows authenticated users with restricted application credentials to create EC2 credentials that inherit the parent user's full S3 permissions, bypassing role restrictions. This privilege escalation affects only deployments combining restricted application credentials with the EC2/S3 compatibility API (swift3/s3api), and requires valid authentication credentials and moderate attack complexity to exploit.
Server-Side Request Forgery in OpenStack Glance image import allows authenticated users to bypass URL validation via HTTP redirects and reach internal services. Affected versions include Glance prior to 29.1.1, 30.0.0 through 30.1.0, and 31.0.0. The vulnerability impacts web-download and glance-download import methods, plus the optional ovf_process plugin. An authenticated attacker can craft a redirect chain to access restricted internal endpoints, though the CVSS vector indicates no confidentiality impact and limited integrity risk (CVSS 5.0). No public exploit code or active exploitation has been confirmed at time of analysis.
An incomplete fix for CVE-2023-1625 was found in openstack-heat. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in python-glance-store. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in OpenStack Barbican containers. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A credentials leak flaw was found in OpenStack Barbican. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An information leak was discovered in OpenStack heat. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
An authorization flaw was found in openstack-barbican. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
A flaw was found in Keystone. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
A flaw was found in python-oslo-utils. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. Rated medium severity (CVSS 5.0).
An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Apache HTTP Server versions 2.4.20 to 2.4.43. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.