CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

CVE-2026-54422

CVE-2026-54422 affects OpenStack Ironic Python Agent up to and including 11.5.0. A malicious boot container deployed via ironic-python-agent can extract the credentials used to download it, enabling credential disclosure on a local attacker. The CVSS metrics indicate a LOCAL attack vector with HI...

CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

PT-2026-64231

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

PT-2026-64233

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...

PYSEC-2026-3492 OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expect...

PYSEC-2026-3486 OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials...

PYSEC-2026-3491 OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

PYSEC-2026-3470 OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image...

PYSEC-2026-3471 OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2, openstack-glance-2026.1, spamcheck, openstack-glance-2025.1-fips, datadog-agent-fips, openstack-placement-2026.1-fips, openstack-horizon-2025.1-fips, openstack-glance-2025.1, openstack-horizon-2025.1, openstack-keystone-2025.1-fips,...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2, openstack-glance-2026.1, spamcheck, openstack-glance-2025.1-fips, datadog-agent-fips, openstack-placement-2026.1-fips, openstack-horizon-2025.1-fips, openstack-glance-2025.1, openstack-horizon-2025.1, openstack-keystone-2025.1-fips,...

RHSA-2026:39812 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update

Bulletin has no description...

RHSA-2026:39810 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

Bulletin has no description...

RHSA-2026:39809 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

Bulletin has no description...

RHSA-2026:39808 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

Bulletin has no description...

Important: Red Hat Security Advisory: Release of containers for RHOSO 18.0.21

Red Hat OpenStack Services on OpenShift RHOSO 18.0.21 containers are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHSA-2026:39811 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) security update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

An update for erlang is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

An update for golang-github-openstack-k8s-operators-os-diff is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...