OpenStack vulnerabilities

CVEs per yearBy the year they were published

1. 20171
2. 20191
3. 20222
4. 20252
5. 202671

Newest CVEs

• CVE-2026-115642

  In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted…

  OpenStack · keystonemiddleware

  High8.3
• CVE-2026-90458

  OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

  OpenStack · Ironic

  Medium5.4
• CVE-2026-89419

  OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…

  OpenStack · Ironic

  Medium5.0
• CVE-2026-115638

  OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

  OpenStack · Ironic

  Medium4.3
• CVE-2026-93856

  In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or…

  OpenStack · Cinder

  Medium4.3
• CVE-2026-71195

  In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize…

  OpenStack · Manila

  Critical9.9
• CVE-2026-97147

  In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then…

  OpenStack · Mistral

  High7.2
• CVE-2026-93861

  In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a…

  OpenStack · Mistral

  Medium6.0
• CVE-2026-93860

  In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any…

  OpenStack · Mistral

  High7.1
• CVE-2026-93858

  In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH…

  OpenStack · Mistral

  High8.7