PT-2026-107673

Name of the Vulnerable Software and Affected Versions OpenStack Zaqar versions prior to 23.0.1 Description In deployments using the WebSocket transport with Keystone authentication, the system fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone...

CVE-2026-102275 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.2-fips, openstack-horizon-2026.1-fips, datadog-agent-fips, awx, openstack-placement-2025.1-fips, kserve-huggingfaceserver-cuda-13.3, openstack-horizon-2025.1-fips, openstack-horizon-2026.1, datahub-ingestion-fips, openstack-horizon-2025.1,...

GHSA-X33G-CR3X-6449 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.2-fips, openstack-horizon-2026.1-fips, datadog-agent-fips, awx, openstack-placement-2025.1-fips, kserve-huggingfaceserver-cuda-13.3, openstack-horizon-2025.1-fips, openstack-horizon-2026.1, datahub-ingestion-fips, openstack-horizon-2025.1,...

CVE-2026-102991 vulnerabilities

Vulnerabilities for packages: nemo-rl-cuda-13.0, openstack-barbican-2026.1, openstack-nova-2026.1, openstack-placement-2025.2, airflow-core, openstack-horizon-2025.2-fips, reflex, openstack-horizon-2026.1-fips, nemo, openstack-keystone-2025.2, openstack-octavia-2025.2,...

GHSA-5639-2J2P-M4MX vulnerabilities

Vulnerabilities for packages: nemo-rl-cuda-13.0, openstack-barbican-2026.1, openstack-nova-2026.1, openstack-placement-2025.2, airflow-core, openstack-horizon-2025.2-fips, reflex, openstack-horizon-2026.1-fips, nemo, openstack-keystone-2025.2, openstack-octavia-2025.2,...

CVE-2026-51772

A flaw was found in OpenStack Glance. When the multiple locations configuration option is enabled, an authenticated attacker can perform Server-Side Request Forgery SSRF by submitting a crafted HTTP request to modify an image's location attributes. This vulnerability allows the attacker to induce...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenStack Aodh and Watcher vulnerability (USN-8870-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8870-1 advisory. Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

CVE-2026-44393 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-nova-2026.1, openstack-glance-2026.1, openstack-neutron-2026.1, openstack-keystone-2026.1, openstack-placement-2026.1...

GHSA-76QH-XR7Q-H39M vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-nova-2026.1, openstack-glance-2026.1, openstack-neutron-2026.1, openstack-keystone-2026.1, openstack-placement-2026.1...

CVE-2026-15307 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

GHSA-Q238-5CXM-5C9H vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

GHSA-WVQV-FJ8W-QMHM vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

CVE-2026-15830 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1, authentik...

CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: authentik-fips, open-webui, superset-fips, nemo-rl-cuda-13.0, openstack-barbican-2026.1, kserve, openstack-nova-2026.1, openstack-placement-2025.2, semgrep, airflow-core, openstack-horizon-2025.2-fips, openstack-horizon-2026.1-fips, datadog-agent-fips,...

GHSA-42VR-XJ54-VC7V vulnerabilities

Vulnerabilities for packages: authentik-fips, open-webui, superset-fips, nemo-rl-cuda-13.0, openstack-barbican-2026.1, kserve, openstack-nova-2026.1, openstack-placement-2025.2, semgrep, airflow-core, openstack-horizon-2025.2-fips, openstack-horizon-2026.1-fips, datadog-agent-fips,...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenStack Designate vulnerability (USN-8860-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8860-1 advisory. It was discovered that OpenStack Designate did not properly validate overlapping zones under certain circumstances...

CVE-2026-97689 vulnerabilities

Vulnerabilities for packages: open-webui, commercial-gitlab-cng-ee-fips, ansible-operator, apache-beam-python-3.11-sdk, openstack-octavia-2025.2, openstack-placement-2025.1-fips, request-1276, tensorflow-gpu-jupyter, kserve-huggingfaceserver-cuda-13.3, py3-pip, openstack-ceph-config-helper-2026.1...

GHSA-VXQ7-64XX-V4GW vulnerabilities

Vulnerabilities for packages: open-webui, commercial-gitlab-cng-ee-fips, ansible-operator, apache-beam-python-3.11-sdk, openstack-octavia-2025.2, openstack-placement-2025.1-fips, request-1276, tensorflow-gpu-jupyter, kserve-huggingfaceserver-cuda-13.3, py3-pip, openstack-ceph-config-helper-2026.1...