OpenStack Open source software for creating private and public clouds

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any OpenStack product.

RSS Feeds for OpenStack security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in OpenStack products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by OpenStack Sorted by Most Security Vulnerabilities since 2018

OpenStack Keystone23 vulnerabilities

OpenStack Nova20 vulnerabilities

OpenStack Neutron18 vulnerabilities

OpenStack Cinder7 vulnerabilities

OpenStack Glance6 vulnerabilities

OpenStack Tripleo Heat Templates5 vulnerabilities

OpenStack Heat3 vulnerabilities

OpenStack Keystonemiddleware3 vulnerabilities

OpenStack Yaql1 vulnerability

OpenStack Murano1 vulnerability

OpenStack Magnum1 vulnerability

OpenStack Glance Store1 vulnerability

OpenStack Glacne Store1 vulnerability

By the Year

In 2026 there have been 3 vulnerabilities in OpenStack with an average score of 9.1 out of ten. Last year, in 2025 OpenStack had 1 security vulnerability published. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.57.

Year	Vulnerabilities	Average Score
2026	3	9.07
2025	1	7.50
2024	7	6.00
2023	13	5.45
2022	10	5.99
2021	6	7.40
2020	8	8.00
2019	13	8.58
2018	13	6.93

It may take a day or so for new OpenStack vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent OpenStack Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-28370	Feb 27, 2026	Vitrage <12.0.1-15.0.0 Query Parser: Code Exec via API In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
CVE-2026-24708	Feb 18, 2026	OpenStack Nova 30.2.2/31.2.1/32.1.1: Flat Image Backend Unsafe Resize An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.	Nova
CVE-2026-22797	Jan 19, 2026	OpenStack keystonemiddleware 10.512 Privilege Escalation via OAuth headers An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.	Keystonemiddleware
CVE-2025-65073	Nov 17, 2025	OpenStack Keystone v3 EC2/S3 Token Abuse via Valid AWS Auth (pre-26.0.1/27/28) OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.	Keystone
CVE-2024-53916	Nov 25, 2024	OpenStack Neutron: Incorrect ID Usage in Policy Enforcement In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.	Neutron
CVE-2024-7319	Aug 02, 2024	OpenStack Heat Sensitive Info Leak via Stack Abandon with Hidden=True An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.	Heat
CVE-2024-40767	Jul 24, 2024	OpenStack Nova <27.4.1/28<28.2.1/29<29.1.1: QCOW2/VMDK Backing File Disclosure In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.	Nova
CVE-2024-32498	Jul 05, 2024	File Access via QCOW2 External Data in OpenStack Cinder<24, Nova<29, Glance<28 An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.	Nova Glance Cinder And others...
CVE-2024-28718	Apr 12, 2024	OpenStack Magnum RCE via cert_manager.py An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component.	Magnum
CVE-2024-29156	Mar 18, 2024	OpenStack Murano 16.0.0 YaQL 'MuranoPL' Env Sanitization Flaw In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.	Yaql Murano
CVE-2024-1141	Feb 01, 2024	Python-Glance-Store Debug Log Exposes Access Key (CVE-2024-1141) A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.	Glacne Store Glance Store
CVE-2023-1633	Sep 24, 2023	OpenStack Barbican Config File Leak allows Authenticated Local Reader A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.	Barbican
CVE-2023-1636	Sep 24, 2023	OpenStack Barbican Container Namespace Escalation via Host Shared CGROUP A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.	Barbican
CVE-2023-1625	Sep 24, 2023	OpenStack Heat 'stack show' Leaks Hidden Parameters An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.	Heat
CVE-2022-45582	Aug 22, 2023	Open Redirect via success_url in VMware Horizon Web Dashboard <=20.1.4 Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.	Horizon
CVE-2023-3637	Jul 25, 2023	OpenStack Neutron DoS via Uncontrolled Resource Consumption (Auth) An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.	Neutron
CVE-2023-2088	May 12, 2023	OpenStack Cinder/Nova Volume Detach Auth Bypass Conf Leak A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.	Cinder
CVE-2022-3101	Mar 23, 2023	Local info disclosure in tripleo-ansible via insecure file perms A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.	Tripleo Ansible
CVE-2022-3146	Mar 23, 2023	TripleO-Ans Local Info Disclosure via Insecure Default Permissions A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.	Tripleo Ansible
CVE-2022-3277	Mar 06, 2023	OpenStack Neutron Authenticated Resource Consumption DoS An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.	Neutron
CVE-2022-4134	Mar 06, 2023	OpenStack Glance: Auth-User Can Tamper Images (CVE20224134) A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.	Glance
CVE-2022-47951	Jan 26, 2023	OpenStack Cinder/Glance/Nova VMDK Path Disclosure Before 26.0.0 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.	Nova Glance Cinder And others...
CVE-2022-3100	Jan 18, 2023	OpenStack Barbican Policy Bypass via Query String A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.	Barbican
CVE-2022-47950	Jan 18, 2023	OpenStack Swift S3 API XML Disclosure (before 2.28.1/2.29.2) An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).	Swift
CVE-2022-38060	Dec 21, 2022	Privilege Escalation via misconfigured sudo in OpenStack Kolla A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.	Kolla
CVE-2022-23451	Sep 06, 2022	OpenStack Barbican Auth Flaw: Auth Users Modify Secret Metadata An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.	Barbican
CVE-2022-2447	Sep 01, 2022	Delayed Token Revocation in OpenStack Keystone (up to 1 hour) A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.	Keystone
CVE-2022-23452	Sep 01, 2022	Auth Bypass in OpenStack Barbican Enabling Secret Injection Across Projects An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.	Barbican
CVE-2022-0718	Aug 29, 2022	oslo-utils Password Disclosure via Debug Log Masking Flaw A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.	Oslo Utils
CVE-2021-3585	Aug 26, 2022	OpenStack-TRIPLEO Log Leak Exposes RHSM Plain Passwords A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.	Tripleo Heat Templates
CVE-2021-3563	Aug 26, 2022	OpenStack Keystone: First 72 Chars Secret Verified Password Bypass A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.	Keystone
CVE-2022-37394	Aug 03, 2022	OpenStack Nova 23.2.2/24.1.2/25.0.2 SR-IOV vnic_type switch causes compute DoS An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.	Nova
CVE-2021-4180	Mar 23, 2022	An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1.	Tripleo Heat Templates
CVE-2021-3654	Mar 02, 2022	A vulnerability was found in openstack-nova's console proxy, noVNC A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.	Nova
CVE-2021-40797	Sep 08, 2021	An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1 An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.	Neutron
CVE-2021-40085	Aug 31, 2021	An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1 An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.	Neutron
CVE-2021-38598	Aug 23, 2021	OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.	Neutron
CVE-2021-38155	Aug 06, 2021	OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.	Keystone
CVE-2017-8761	Jun 02, 2021	In OpenStack Swift through 2.10.1 In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.	Swift
CVE-2021-20267	May 28, 2021	A flaw was found in openstack-neutron's default Open vSwitch firewall rules A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.	Neutron
CVE-2020-29565	Dec 04, 2020	An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.	Horizon
CVE-2020-26943	Oct 16, 2020	An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0 An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.	Blazar Dashboard
CVE-2020-17376	Aug 26, 2020	An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.	Nova
CVE-2020-12689	May 07, 2020	An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.	Keystone
CVE-2020-12690	May 07, 2020	An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.	Keystone
CVE-2020-12691	May 07, 2020	An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.	Keystone
CVE-2020-12692	May 07, 2020	An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.	Keystone
CVE-2020-9543	Mar 12, 2020	OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.	Manila
CVE-2012-5474	Dec 30, 2019	The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value. The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.	Horizon
CVE-2013-2167	Dec 10, 2019	python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass	Python Keystoneclient