PYSEC-2026-832 OpenStack Keystone Improper Authentication vulnerability

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

OpenStack Keystone Improper Authentication vulnerability

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

PYSEC-2026-883 OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

PYSEC-2026-790 OpenStack Cinder Denial of Service using XML entities

The 1 backup api/contrib/backups.py and 2 volume transfer contrib/volumetransfer.py APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack. NOTE: this issue is due to an...

OpenStack Cinder Denial of Service using XML entities

The 1 backup api/contrib/backups.py and 2 volume transfer contrib/volumetransfer.py APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack. NOTE: this issue is due to an...

PYSEC-2026-877 OpenStack Compute (nova) allows remote authenticated users to cause a denial of service

OpenStack Compute nova before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service disk consumption by deleting instances while in the resize state...

PYSEC-2026-872 OpenStack Nova VMware instance leak potentially leading to compute DoS

The VMware driver in OpenStack Compute Nova before 2014.1.4 allows remote authenticated users to cause a denial of service disk consumption by deleting an instance in the resize state...

OpenStack Nova VMware instance leak potentially leading to compute DoS

The VMware driver in OpenStack Compute Nova before 2014.1.4 allows remote authenticated users to cause a denial of service disk consumption by deleting an instance in the resize state...

PYSEC-2026-815 OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of...

OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of...

CVE-2026-43000 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

CVE-2026-44394 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

GHSA-8F8M-WRVR-WCVF vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

GHSA-WHQR-FGM5-X77Q vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

CVE-2026-42998 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

CVE-2026-42999 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

GHSA-Q623-F4J4-P4XJ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2025.2-fips...

OpenStack Nova Filter Scheduler Bypass

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters for example, the ImagePropertiesFilter or the IsolatedHostsFilter. All setups using Nova Filter...