CVE-2026-71191: Incorrect Authorization

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

Linux Distros Unpatched Vulnerability : CVE-2026-71192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests whe...

Linux Distros Unpatched Vulnerability : CVE-2026-71201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another...

Linux Distros Unpatched Vulnerability : CVE-2026-71191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. ...

PT-2026-67961

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.1 Description The proxy server Accept header parser uses a regular expression with a qdtext pattern ?:^"|. that is susceptible to catastrophic backtracking, a type of Regular Expression Denial of Service...

Linux Distros Unpatched Vulnerability : CVE-2026-71190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The qdtext...

CVE-2026-71192: Incorrect Authorization

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

GHSA-G6CJ-PR64-35W5 vulnerabilities

Vulnerabilities for packages: mycli, ggshield, openstack-horizon-2025.1, azureml-inference-server-http, awx, crossplane-function-pythonic, gitlab-cng, openstack-horizon-2026.1, openstack-tempest-2025.2, authentik, dbt-bigquery, duplicity, metaflow-service, tritonserver-backend-vllm-cuda-13.0,...

CVE-2026-69247 vulnerabilities

Vulnerabilities for packages: mycli, ggshield, openstack-horizon-2025.1, azureml-inference-server-http, awx, crossplane-function-pythonic, gitlab-cng, openstack-horizon-2026.1, openstack-tempest-2025.2, authentik, dbt-bigquery, duplicity, metaflow-service, tritonserver-backend-vllm-cuda-13.0,...

[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

OVHcloud Backup Configuration - Exposure Detection

Detected exposed OVHcloud backup configuration files ovh-backups.json containing sensitive credentials such as OpenStack/Swift authentication details, API keys, and storage configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed OVHcloud backup configuration files...

Openstack - Infomation Disclosure Detection

Openstack exposing Configuration or settings related to the Swift object storage system. !/usr/bin/env python3 -- coding: utf-8 -- """Openstack exposing Configuration or settings related to the Swift object storage system.""" from kittysploit import from lib.protocols.http.httpclient import...

OpenStack User Secrets Exposure Detection

Internal usersecrets.yml file is exposed in OpenStack. !/usr/bin/env python3 -- coding: utf-8 -- """Internal usersecrets.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenStack User Secrets Exposure Detection',...

OpenStack Dashboard Login Panel - Detect

OpenStack Dashboard login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenStack Dashboard login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenStack Dashboard Login Panel...

GHSA-J5G9-F88F-GFJ3 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.1, openstack-placement-2025.1-fips, openstack-horizon-2026.1, openstack-keystone-2025.1-fips, authentik, duplicity, openstack-horizon-2026.1-fips, openstack-glance-2026.1, openstack-nova-2025.1, openstack-placement-2026.1-fips,...

CVE-2026-59939 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.1, openstack-placement-2025.1-fips, openstack-horizon-2026.1, openstack-keystone-2025.1-fips, authentik, duplicity, openstack-horizon-2026.1-fips, openstack-glance-2026.1, openstack-nova-2025.1, openstack-placement-2026.1-fips,...

Linux Distros Unpatched Vulnerability : CVE-2026-54422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic- python-agent, may be able to extract the credentials...

Linux Distros Unpatched Vulnerability : CVE-2026-66139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. CVE-2026-66139 Note that Nessus relies on the presenc...

CVE-2026-54422

A flaw was found in OpenStack ironic-python-agent's bootc container deployment support. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator...