PYSEC-2026-892 OpenStack Oslo utility sensitive information exposure via log files

The strutils.maskpassword function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log...

PYSEC-2026-861 OpenStack Nova instance migration process does not stop when instance is deleted

OpenStack Compute nova 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service disk, network, and other resource consumption by resizing and then deleting an instance...

PYSEC-2026-873 OpenStack Nova live snapshots use an insecure local directory

OpenStack Compute Nova Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots...

PYSEC-2026-867 OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

OpenStack Compute Nova before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made...

PYSEC-2026-869 OpenStack Compute (Nova)'s VMWare driver vulnerable to denial of service

The VMWare driver in OpenStack Compute Nova before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service resource consumption by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: thi...

PYSEC-2026-863 OpenStack Compute (Nova) Denial of Service vulnerability

OpenStack Compute Nova before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service CPU consumption via an IP filter in a list active servers API request...

PYSEC-2026-864 OpenStack Nova host data access through resize/migration

The libvirt driver in OpenStack Compute Nova before 2015.1.4 kilo and 12.0.x before 12.0.3 liberty, when using raw storage and usecowimages is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk...

PYSEC-2026-872 OpenStack Nova VMware instance leak potentially leading to compute DoS

The VMware driver in OpenStack Compute Nova before 2014.1.4 allows remote authenticated users to cause a denial of service disk consumption by deleting an instance in the resize state...

PYSEC-2026-815 OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of...

GHSA-Q623-F4J4-P4XJ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

CVE-2026-44394 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

GHSA-8F8M-WRVR-WCVF vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

CVE-2026-42999 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

GHSA-WHQR-FGM5-X77Q vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

CVE-2026-42998 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

CVE-2026-43000 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2025.1, openstack-keystone-2026.1-fips, openstack-keystone-2025.2, openstack-keystone-2026.1...

PYSEC-2026-619 Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

PYSEC-2026-754 Openstack tripleo-heat-templates unauthenticated file access

A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...

PYSEC-2026-689 OpenStack Nova Denial of service attack on the compute host

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. The same code error...