OpenStack Open source software for creating private and public clouds

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any OpenStack product.

RSS Feeds for OpenStack security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in OpenStack products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by OpenStack Sorted by Most Security Vulnerabilities since 2018

OpenStack Keystone33 vulnerabilities

OpenStack Nova21 vulnerabilities

OpenStack Neutron21 vulnerabilities

OpenStack Horizon17 vulnerabilities

OpenStack Ironic14 vulnerabilities

OpenStack Swift11 vulnerabilities

OpenStack Glance8 vulnerabilities

OpenStack Cinder7 vulnerabilities

OpenStack Tripleo Heat Templates5 vulnerabilities

OpenStack Octavia3 vulnerabilities

OpenStack Heat3 vulnerabilities

OpenStack Keystonemiddleware3 vulnerabilities

OpenStack Ironic Python Agent2 vulnerabilities

OpenStack Designate2 vulnerabilities

OpenStack Yaql1 vulnerability

OpenStack Murano1 vulnerability

OpenStack Magnum1 vulnerability

OpenStack Glance Store1 vulnerability

OpenStack Glacne Store1 vulnerability

By the Year

In 2026 there have been 51 vulnerabilities in OpenStack with an average score of 6.5 out of ten. Last year, in 2025 OpenStack had 1 security vulnerability published. That is, 50 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.96

Year	Vulnerabilities	Average Score
2026	51	6.54
2025	1	7.50
2024	7	6.00
2023	13	5.45
2022	10	5.99
2021	6	7.40
2020	8	8.00
2019	13	8.58
2018	13	6.93

It may take a day or so for new OpenStack vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent OpenStack Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-80183	Aug 26, 2026	OpenStack Keystone <29.0.3: Auth Role Harvest via GET /role_assignments In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in list_role_assignments_for_tree.	Keystone
CVE-2026-80184	Aug 25, 2026	OpenStack Keystone <29.0.3: Delegated Auth Token Scope Escalation In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.	Keystone
CVE-2026-80182	Aug 25, 2026	OpenStack Keystone <29.0.3 OAuth1 Delegation PrivEsc In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.	Keystone
CVE-2026-77648	Aug 20, 2026	OpenStack Glance < 32.0 SSRF via /v2/tasks Import API In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.	Glance
CVE-2026-76878	Aug 19, 2026	OpenStack Aodh API Bypass Project Scoping (pre 22.0.1) In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0).
CVE-2026-74250	Aug 14, 2026	OpenStack Ironic <38.0.1 - Autodetect Deploy Cleaning Failure In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.	Ironic
CVE-2026-74248	Aug 14, 2026	OpenStack Octavia QoS Auth Bypass before 18.0.0 (prevents QoS policy deletion) OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.	Octavia
CVE-2026-71194	Aug 12, 2026	OpenStack Designate mDNS Pool-Blind Lookup (before 22.0.2) In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.	Designate
CVE-2026-71193	Aug 12, 2026	OpenStack Designate before 22.0.1 Cross-Tenant DNS Hijack via AttributeFilter In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.	Designate
CVE-2026-71201	Aug 05, 2026	OpenStack Ironic 38.0.0 Info Disclosure: crossproj Portgroups In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.	Ironic
CVE-2026-71192	Aug 05, 2026	OpenStack Swift S3API s3_acl=true header injection bypass (2.38.0) In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.	Swift
CVE-2026-71191	Aug 05, 2026	OpenStack Swift 2.38.0 S3API SigV4 Header Injection (CVE-2026-71191) In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.	Swift
CVE-2026-71190	Aug 05, 2026	OpenStack Swift 2.38.0 ReDoS in Proxy Accept Header Parser (CVE-2026-71190) In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]\|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.	Swift
CVE-2026-55707	Aug 05, 2026	Neutron Subnet Onboarding Auth Bypass (v<28.0.2) In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.	Neutron
CVE-2026-66139	Jul 24, 2026	OpenStack Zaqar <22.0.0 Authentication Bypass via EXTRA-SPEC Header OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.
CVE-2026-66138	Jul 24, 2026	CVE-2026-66138: Ironic-Python-Agent pre-11.6.0 ntp_server shell exec In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.	Ironic Python Agent
CVE-2026-54422	Jul 24, 2026	OpenStack Ironic Python Agent 11.5.0 Credential Leak in bootc In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.	Ironic Python Agent
CVE-2026-54423	Jul 10, 2026	OpenStack Ironic <37.0.1 IPMI send_raw RCE In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.	Ironic
CVE-2026-44918	Jul 10, 2026	OpenStack Ironic <37.0.1: Cross-Project Node Creation/Modification Bypass OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.	Ironic
CVE-2026-50221	Jun 23, 2026	OpenStack Swift <2.37.2 SSRF via Authenticated Header Injection In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.	Swift
CVE-2026-55748	Jun 17, 2026	OpenStack Horizon <25.7.4 RC file script download may exec shell meta OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.	Horizon
CVE-2026-46448	Jun 16, 2026	OpenStack Nova <33.0.2: Server Create API Misses Placement Alloc In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.	Nova
CVE-2026-54421	Jun 14, 2026	OpenStack Ironic 35.0.1: PATCH on volume props leaks iSCSI creds In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.	Ironic
CVE-2026-50589	Jun 04, 2026	Unauth Service Crash via Crafted JSON in OpenStack Ironic 32-35.0.1 In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.	Ironic
CVE-2026-50266	Jun 04, 2026	OpenStack Neutron Shared Net Port Spoofing via Project Manager RBAC (28.0.1) In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).	Neutron
CVE-2026-48681	Jun 04, 2026	OpenStack Ironic <35.0.2: DT File Overwrite Vulnerability in ISO Deployer OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.	Ironic
CVE-2026-44917	Jun 04, 2026	OpenStack Ironic <35.0.2 Local File Read via PXE Template OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.	Ironic
CVE-2026-41283	Jun 04, 2026	OpenStack Mistral RCE via API before 22.0.0 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
CVE-2026-46447	Jun 03, 2026	OpenStack Ironic <=35.0.x Boot Script Injection OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.	Ironic
CVE-2026-49299	May 28, 2026	OpenStack Neutron <28.0.1 Plural Action Mismatch Enables Unauthorized Tagging In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.	Neutron
CVE-2026-44394	May 28, 2026	OpenStack Keystone <29.0.2: Rescope Token Exploit to Bypass Expiry An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.	Keystone
CVE-2026-43000	May 28, 2026	OpenStack Keystone Pre-29.0.2 Priv Esc via Impersonation + Trust An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.	Keystone
CVE-2026-42999	May 28, 2026	OpenStack Keystone RBAC Bypass via Untrusted JSON Merge (pre-29.0.2) An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).	Keystone
CVE-2026-42998	May 28, 2026	Keystone Auth Plugin Priv Escalation before 29.0.2 An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.	Keystone
CVE-2026-49017	May 27, 2026	OpenStack Swift s3api infinite loop causes DoS (pre 2.36.2/2.37.2) In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.	Swift
CVE-2026-44919	May 14, 2026	OpenStack Ironic Infinite Loop via file:///dev/zero URL In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.	Ironic
CVE-2026-44916	May 08, 2026	OpenStack Ironic ks_template unsandboxed rendering In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.	Ironic
CVE-2026-40214	May 07, 2026	OpenStack Cyborg <16.0.1: ARQ API Cross-Tenant DoS Vulnerability In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
CVE-2026-40213	May 07, 2026	OpenStack Cyborg <=16.0.1 Unauthenticated Policy Bypass via Rule:allow (@) OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.
CVE-2026-43002	May 05, 2026	Unauth Session Store Exhaustion in OpenStack Horizon 25.625.7 (pre25.7.3) An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.	Horizon
CVE-2026-42997	May 05, 2026	OpenStack Ironic idrac Remote Credential Exposure <=35.0.1 An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.	Ironic
CVE-2026-43001	May 01, 2026	Keystone /v3/credentials Unvalidated project_id Enables EC2 Token Cross-Project Lateral Movement An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.	Keystone
CVE-2026-43003	May 01, 2026	Arbitrary Code Exec via grub-install in OpenStack iPythonAgent <11.5.0 An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.	Ironic
CVE-2026-42510	Apr 28, 2026	OpenStack Ironic <=25.0.0 IPMI Tool Execution via Console Interface OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.	Ironic
CVE-2026-40683	Apr 14, 2026	OpenStack Keystone 28.0.1 LDAP Boolean Issue: Disabled Users Enabled In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed string-to-boolean conversion when user_enabled_invert was True. When False, the raw string value from LDAP (e.g., "FALSE") was used directly. Since non-empty strings are truthy in Python, users marked as disabled in LDAP were treated as enabled by Keystone, allowing them to authenticate and perform actions. All deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected.	Keystone
CVE-2026-33551	Apr 10, 2026	OpenStack Keystone 14-26,27,28,29: Restricted App Creds Escalate EC2/S3 An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.	Keystone
CVE-2026-40212	Apr 10, 2026	OpenStack Skyline <5.0.1,6.0.0,7.0.0: Console DOM XSS via document.write OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs.
CVE-2026-34881	Mar 31, 2026	OpenStack Glance SSRF via Import Redirect (<29.1.1, 30.0.030.1.0, 31.0.0) OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.	Glance
CVE-2026-28370	Feb 27, 2026	Vitrage <12.0.1-15.0.0 Query Parser: Code Exec via API In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
CVE-2026-24708	Feb 18, 2026	OpenStack Nova 30.2.2/31.2.1/32.1.1: Flat Image Backend Unsafe Resize An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.	Nova