[ Vendor · 9 CVEs ]
OpenStack
CVEs affecting OpenStack published in the last 30 days, plus any OpenStack CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-93856 | 21 Oct 2026 | CVSS 4.3 | OpenStack CinderIn OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped… | |
| CVE-2026-71195 | 21 Oct 2026 | CVSS 9.9 | OpenStack ManilaIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers… | |
| CVE-2026-97147 | 8 Oct 2026 | CVSS 7.2 | OpenStack MistralIn OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's… | |
| CVE-2026-93861 | 8 Oct 2026 | CVSS 6.0 | OpenStack MistralIn OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow… | |
| CVE-2026-93858 | 8 Oct 2026 | CVSS 8.7 | OpenStack MistralIn OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand()… | |
| CVE-2026-93860 | 8 Oct 2026 | CVSS 7.1 | OpenStack MistralIn OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without… | |
| CVE-2026-107363 | 7 Oct 2026 | CVSS 6.1 | OpenStack ZaqarIn OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by… | |
| CVE-2026-97404 | 24 Sep 2026 | CVSS 9.2 | OpenStack ZaqarIn OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an… | |
| CVE-2026-97149 | 24 Sep 2026 | CVSS 5.3 | OpenStack SwiftIn OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the… |