Vulnerabilidades de OpenStack
CVEs publicadas que afetam produtos de OpenStack: 59 registro(s), com severidade, exploração e correções.
Ironic 14Keystone 11Swift 6Mistral 5Ironic Python Agent 3Neutron 3Glance 2Nova 2Horizon 2Cyborg 2Zaqar 2Designate 2Aodh 1Vitrage 1Octavia 1Keystonemiddleware 1Skyline 1
CVE-2026-42510
Alta · 7.2
CWE-829 28/04/2026
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration…
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
CVE-2026-40683
Alta · 7.7
CWE-843 14/04/2026
Type Confusion em OpenStack Keystone
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.
CVE-2026-40212
Média · 5.4
CWE-79 10/04/2026
Cross-site Scripting (XSS) em OpenStack Skyline
OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs.
CVE-2026-33551
Média · 5.3
CWE-863 10/04/2026
Incorrect Authorization em OpenStack Keystone
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
CVE-2026-34881
Média · 5.0
CWE-918 31/03/2026
Server-Side Request Forgery (SSRF) em OpenStack Glance
OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.
CVE-2026-28370
Crítica · 9.1
CWE-95 27/02/2026
Eval Injection em OpenStack Vitrage
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
CVE-2026-24708
Alta · 8.2
CWE-669 18/02/2026
Incorrect Resource Transfer Between Spheres em OpenStack Nova
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
CVE-2026-22797
Crítica · 9.9
CWE-290 19/01/2026
Authentication Bypass by Spoofing em OpenStack Keystonemiddleware
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
CVE-2025-65073
Alta · 7.5
CWE-863 17/11/2025
Incorrect Authorization em OpenStack Keystone
OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.