GHSA-GF2Q-J2QQ-PJF2 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2012-4413 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2026-90460

A flaw was found in OpenStack Keystone. Tokens obtained via delegated authentication methods trusts, application credentials, OAuth1 access tokens can move a credential to an unauthorized project by supplying a new projectid in a PATCH /v3/credentials request, because only the pre-update project ...

Linux Distros Unpatched Vulnerability : CVE-2026-107363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keysto...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

DEBIAN-CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

UBUNTU-CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

EUVD-2026-94614

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before version 23.0.1 , a vulnerability exists in the WebSocket transport where it fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token . An authenticated user with a valid token for one project can substitute another pr...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363: External Control of Assumed-Immutable Web Parameter

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

PT-2026-107673

Name of the Vulnerable Software and Affected Versions OpenStack Zaqar versions prior to 23.0.1 Description In deployments using the WebSocket transport with Keystone authentication, the system fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: PCI: Keystone: Fixed the if-statement expression in kspciequirk. This code accidentally used && where || was intended. This could potentially lead to a NULL derefrence error. Therefore, the if-statement expression should be...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: PCI: Keystone: Added a workaround for Errata i2037 AM65x SR 1.0 Errata i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0 SPRZ452DJuly 2018Revised December 2019 1 mentions that when an inbound PCIe TLP spans more than two...

GHSA-42VR-XJ54-VC7V vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, wazuh-manager, netbox-fips, openstack-heat-2025.2, openstack-placement-2025.2, datadog-agent-fips, openstack-glance-2025.1-fips, request-1276, authentik-fips, openstack-horizon-2025.1,...

CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, wazuh-manager, netbox-fips, openstack-heat-2025.2, openstack-placement-2025.2, datadog-agent-fips, openstack-glance-2025.1-fips, request-1276, authentik-fips, openstack-horizon-2025.1,...