PYSEC-2026-3471 OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: mlflow-fips, openstack-placement-2025.2, vast-csi, openstack-glance-2026.1, azure-functions-python-worker, openstack-horizon-2025.2, kubeflow-volumes-web-app, spamcheck, ansible-operator, pgadmin4, wazuh-manager-fips, authentik, openstack-horizon-2025.1-fips, httpie,...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: mlflow-fips, openstack-placement-2025.2, vast-csi, openstack-glance-2026.1, azure-functions-python-worker, openstack-horizon-2025.2, kubeflow-volumes-web-app, spamcheck, ansible-operator, pgadmin4, wazuh-manager-fips, authentik, openstack-horizon-2025.1-fips, httpie,...

PT-2026-64082

OpenStack Ironic through 35.0.x allows Boot Script Injection...

PT-2026-64096

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials...

PT-2026-64101

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl ca file is configured, the driver enables certificate chain validation but does not pass the...

RHSA-2026:39812 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update

Bulletin has no description...

RHSA-2026:39810 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

Bulletin has no description...

RHSA-2026:39809 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

Bulletin has no description...

RHSA-2026:39808 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

Bulletin has no description...

RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) (RHSA-2026:39808)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39808 advisory. Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. Security Fixes: Keystone: OpenStack...

Important: Red Hat Security Advisory: Release of containers for RHOSO 18.0.21

Red Hat OpenStack Services on OpenShift RHOSO 18.0.21 containers are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHSA-2026:39811 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) security update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-glance) security update

An update for openstack-glance is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openstack-glance: OpenStack Glance: Server-Side Request Forgery leading to unauthorized internal network access

A flaw was found in OpenStack Glance. An authenticated user can exploit a Server-Side Request Forgery SSRF vulnerability within the web-download import feature. This vulnerability stems from inadequate validation of Uniform Resource Identifiers URIs, which can be circumvented using HTTP redirects...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

An update for erlang is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

An update for golang-github-openstack-k8s-operators-os-diff is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

OpenStack Ironic: OpenStack Ironic: Information disclosure via credential forwarding during mold import

A flaw was found in OpenStack Ironic. During the import process, a user invoking molds can request that authorization credentials be sent to a remote endpoint. This can lead to the disclosure of a time-limited Keystone token, which grants access to OpenStack services Ironic is authorized for, or...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-ironic) security update

An update for openstack-ironic is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...