Important: Red Hat Security Advisory: Release of containers for RHOSO 18.0.22

Red Hat OpenStack Services on OpenShift RHOSO 18.0.22 containers are now available. Red Hat OpenStack Services on OpenShift is a hybrid cloud solution for deploying and managing virtualized and containerized applications in a scalable infrastructure with a Red Hat OpenShift Container Platform RHO...

Important: Red Hat Security Advisory: Updated Red Hat OpenStack Platform 17.1 director Operator container images

Updated container images are now available for director Operator for Red Hat OpenStack Platform 17.1 Wallaby for RHEL 9.2. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service IaaS cloud running on commonly...

Important: Red Hat Security Advisory: Updated Red Hat OpenStack Platform 16.2 director Operator container images

Updated container images are now available for director Operator for Red Hat OpenStack Platform 16.2 Train for RHEL 8.4. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service IaaS cloud running on commonly availab...

CVE-2026-115638

A flaw was found in OpenStack Ironic. An authenticated remote attacker can exploit this issue by supplying a specially crafted configuration drive containing compressed data that expands to an excessively large size. Processing this data can exhaust system memory and storage resources, leading to...

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

keystone: OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse

A flaw was found in OpenStack Keystone. An attacker with a member role on a project can escalate their privileges to an administrator role. This is achieved by combining an application credential impersonation vulnerability with the misuse of Keystone trusts. The system incorrectly validates...

openstack-nova: OpenStack Nova: Resource allocation issue due to unstripped hint data in server creation API

A flaw was found in OpenStack Nova. The server creation application programming interface API fails to remove specific hint data, leading to instances being created without proper Placement allocation. This can result in a denial of service, as resources may not be correctly assigned or managed f...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 security advisory

Updated packages that resolve security issues are now available for Red Hat OpenStack Platform 13.0 for Red Hat Enterprise Linux RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

SUSE CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

RHEL 7 : Red Hat OpenStack Platform 13.0 security advisory (Important) (RHSA-2026:94039)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94039 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

GHSA-2QM8-X737-GMW5 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

GHSA-9M75-VC3G-4X39 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

GHSA-FM9C-5RCF-2Q5P vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

GHSA-MM57-4V3P-RCHX vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

CVE-2026-119194 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

CVE-2026-119195 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

CVE-2026-119196 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

CVE-2026-119197 vulnerabilities

Vulnerabilities for packages: dbt-bigquery, openstack-ironic-2026.1, snuba, wazuh-manager-fips, openstack-octavia-2026.1, openstack-octavia-2026.2, nemo-gym, elastic-connectors, superset, superset-fips, vllm-openai-cuda-12.9, localstack, litellm-fips, openstack-keystone-2026.1-fips, wazuh-manager...

DEBIAN-CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...