May 2026 - OpenStack-announce - lists.openstack.org

[OSSA-2026-016] OpenStack Neutron: Tagging policy bypass allows project readers to mutate tags (CVE-2026-pending)
by Goutham Pacha Ravi 29 May '26

29 May '26

================================================================================== OSSA-2026-016: Neutron tagging policy bypass allows project readers to mutate tags ================================================================================== :Date: May 28, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Neutron: >=26.0.0 <26.0.4, >=27.0.0 <27.0.3, >=28.0.0 <28.0.1 Description ~~~~~~~~~~~ Tim Shephard from roiai.ca reported a policy enforcement bypass in Neutron's tagging controller. The controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected. Patches ~~~~~~~ - https://review.opendev.org/989376 (2025.1/epoxy) - https://review.opendev.org/989375 (2025.2/flamingo) - https://review.opendev.org/989374 (2026.1/gazpacho) - https://review.opendev.org/989099 (2026.2/hibiscus) Credits ~~~~~~~ - Tim Shephard from roiai.ca (CVE-2026-pending) References ~~~~~~~~~~ - https://launchpad.net/bugs/2150132 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes ~~~~~ - CVE assignment is pending (MITRE CAN-2026-2030611). -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-015] OpenStack Keystone: Multiple credential delegation and authorization bypass vulnerabilities (CVE-2026-42998, CVE-2026-42999, CVE-2026-43000, CVE-2026-43001, CVE-2026-44394)
by Goutham Pacha Ravi 29 May '26

29 May '26

================================================================================================== OSSA-2026-015: Multiple credential delegation and authorization bypass vulnerabilities in Keystone ================================================================================================== :Date: May 28, 2026 :CVE: CVE-2026-42998, CVE-2026-42999, CVE-2026-43000, CVE-2026-43001, CVE-2026-44394 Affects ~~~~~~~ - Keystone: >=14.0.0 <27.0.2, >=28.0.0 <28.0.2, >=29.0.0 <29.0.2 Description ~~~~~~~~~~~ Boris Bobrov from SAP SE reported that an authenticated attacker can inject RBAC policy targets via the JSON request body, bypassing authorization on any policy-protected endpoint to read credential secrets, create credentials for arbitrary users, and escalate to cloud admin (CVE-2026-42999). Application credential authentication does not verify the caller owns the credential, enabling user impersonation within a shared project (CVE-2026-42998). This impersonation can be chained with trusts to escalate from member to admin, with the resulting trust persisting independently (CVE-2026-43000). Tim Shepherd from roiai.ca reported that application credentials scoped to one project can create EC2 credentials for a different project (CVE-2026-43001). Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that federated users can maintain access indefinitely by repeatedly rescoping tokens before expiry, as each rescope issues a fresh full-TTL token instead of inheriting the original expiry (CVE-2026-44394). Additionally, Artem Goncharov from SysEleven GmbH identified related issues in trust-scoped token handling and policy enforcement during investigation. All Keystone deployments are affected; CVE-2026-44394 only affects SAML2/OIDC deployments. Patches ~~~~~~~ - https://review.opendev.org/990500 (2025.1/epoxy) - https://review.opendev.org/990501 (2025.1/epoxy) - https://review.opendev.org/990502 (2025.1/epoxy) - https://review.opendev.org/990503 (2025.1/epoxy) - https://review.opendev.org/990504 (2025.1/epoxy) - https://review.opendev.org/990495 (2025.2/flamingo) - https://review.opendev.org/990496 (2025.2/flamingo) - https://review.opendev.org/990497 (2025.2/flamingo) - https://review.opendev.org/990498 (2025.2/flamingo) - https://review.opendev.org/990499 (2025.2/flamingo) - https://review.opendev.org/990490 (2026.1/gazpacho) - https://review.opendev.org/990491 (2026.1/gazpacho) - https://review.opendev.org/990492 (2026.1/gazpacho) - https://review.opendev.org/990493 (2026.1/gazpacho) - https://review.opendev.org/990494 (2026.1/gazpacho) - https://review.opendev.org/990485 (2026.2/hibiscus) - https://review.opendev.org/990486 (2026.2/hibiscus) - https://review.opendev.org/990487 (2026.2/hibiscus) - https://review.opendev.org/990488 (2026.2/hibiscus) - https://review.opendev.org/990489 (2026.2/hibiscus) Credits ~~~~~~~ - Boris Bobrov from SAP SE (CVE-2026-42998, CVE-2026-42999, CVE-2026-43000) - Tim Shepherd from roiai.ca (CVE-2026-43001) - Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-44394) - Artem Goncharov from SysEleven GmbH References ~~~~~~~~~~ - https://launchpad.net/bugs/2148398 - https://launchpad.net/bugs/2148477 - https://launchpad.net/bugs/2149775 - https://launchpad.net/bugs/2149789 - https://launchpad.net/bugs/2150089 - https://launchpad.net/bugs/2150379 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42998 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42999 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43000 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43001 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44394 Notes ~~~~~ - The fix for CVE-2026-42999 modifies the trust policy structure. Deployments with customized trust policies may experience issues with image upload and Heat service functionality until the custom policy is updated. - CVE-2026-44394 only affects deployments using SAML2 or OIDC federation. -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-014] OpenStack Swift: Swift proxy-server denial of service via truncated s3api chunked upload (CVE-2026-49017)
by Goutham Pacha Ravi 28 May '26

28 May '26

====================================================================================== OSSA-2026-014: Swift proxy-server denial of service via truncated s3api chunked upload ====================================================================================== :Date: May 27, 2026 :CVE: CVE-2026-49017 Affects ~~~~~~~ - Swift: >=2.36.0 <2.36.2, >=2.37.0 <2.37.2 Description ~~~~~~~~~~~ Alistair Coles from NVIDIA reported a denial of service vulnerability in Swift's s3api middleware. An authenticated user can send a truncated aws-chunked PUT request that causes a proxy-server worker to enter an infinite loop, consuming CPU and memory until the process becomes permanently unresponsive. Deployments running Swift 2.36.0 or later with the s3api middleware enabled are affected. Patches ~~~~~~~ - https://review.opendev.org/990262 (2025.2/flamingo) - https://review.opendev.org/990261 (2026.1/gazpacho) - https://review.opendev.org/987957 (2026.2/hibiscus) Credits ~~~~~~~ - Alistair Coles from NVIDIA (CVE-2026-49017) References ~~~~~~~~~~ - https://launchpad.net/bugs/2152205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49017 -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-013] Ironic: Denial of Service via specially crafted deployment requests (CVE-2026-44919)
by Jay Faulkner 20 May '26

20 May '26

====================================================================================== OSSA-2026-013: Denial of Service in Ironic under specially crafted deployment requests ====================================================================================== :Date: May 19, 2026 :CVE: CVE-2026-44919 Affects ~~~~~~~ - Ironic: >=23.0.4 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2 Description ~~~~~~~~~~~ Erichen of the Institute of Computing Technology at the Chinese Academy of Sciences reported a vulnerability in Ironic's image handling code where an authenticated and appropriately authorized user could request a special device or file path be deployed, where checksum evaluation would occur in advance of file path checking being asserted. This was a change introduced as a follow-up to soften CVE-2024-47211 image handling since "files on disk" are considered artifacts placed by the deployer/manager of the Ironic deployment. The result was that the user could request a deployment where the requested disk image was a special file, such as "file:///dev/zero", which would consume a conductor thread. This is a direct result of the auto-checksum behavior attempting to checksum the file. Repeated similar requests could then be leveraged to exhaust the available pool of Ironic conductor threads resulting in a denial-of-service until the service is restarted. Any authenticated user with access to write to ``node.instance_info`` and deploy a node can trigger this DoS. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/988480 (2023.1/antelope (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/988359 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/988357 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/988356 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/988355 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/988325 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/ironic/+/988765 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/988764 (Bugfix/34.0) Credits ~~~~~~~ - Erichen from Institute of Computing Technology, Chinese Academy of Sciences References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150332 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44919 Notes ~~~~~ - Operators and vendors who backported https://review.opendev.org/q/Ib2fd5dcbee9a9d1c7e32770ec3d9b6cb20a2e2a titled "Calculate missing checksum for file:// based images" are vulnerable to this issue. Backports were made available to Xena, Wallaby, and Victoria releases which did not land in OpenDev Gerrit. Backports to the Zed, 2023.1, 2023.2, 2024.1, 2024.2, release branches occured and were merged into OpenDev Gerrit, but were not universally released to release branch and maintenance policies of the OpenStack project. The affected product versions range covers these releases as released by the OpenStack community. - Operators or vendors who may have backported patches independently of upstream should take the action of backporting this fix along with ensuring that they have the appropriate fix for OSSA-2025-001, from https://review.opendev.org/q/I2fa995439ee500f9dd82ec8ccfa1a25ee8e1179c if not already backported. - Patches are provided for active Ironic bugfix branches. Bugfix branches will not get an updated release of Ironic. - Patches are provided for unmaintained branches as a courtesy. These branches will not recieve updated releases.

1 0

[OSSA-2026-012] Ironic: Remote Code Execution when Anaconda driver enabled
by Jay Faulkner 12 May '26

12 May '26

===================================================================================== OSSA-2026-012: Remote Code Execution in Ironic conductor when Anaconda driver enabled ===================================================================================== :Date: May 11, 2026 :CVE: CVE-2026-44916 Affects ~~~~~~~ - Ironic: >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2 Description ~~~~~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team reported a vulnerability in Ironic's anaconda deploy interface. Users who can set ``node.instance_info['ks_template']`` can achieve remove code execution on the ironic-conductor process, as the template is rendered without sandboxing. In the default configuration, Ironic is not vulnerable to this issue. However, operators who have enabled the anaconda deploy interface by adding it to ``[conductor]/enabled_deploy_interfaces`` and have untrusted users with access to modify ``node.instance_info`` are at risk. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/987778 (2023.1/antelope (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/987777 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/987776 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/987775 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/987774 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/987922 (Bugfix/31.0) - https://review.opendev.org/c/openstack/ironic/+/987921 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/987920 (Bugfix/34.0) Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2148307 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44916 Notes ~~~~~ - Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmation) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches.

1 0

[OSSA-2026-011] Cyborg: Multiple access control vulnerabilities in Cyborg accelerator management (CVE-2026-40213, CVE-2026-40214)
by Goutham Pacha Ravi 08 May '26

08 May '26

================================================================ OSSA-2026-011: Multiple access control vulnerabilities in Cyborg accelerator management ================================================================ :Date: May 07, 2026 :CVE: CVE-2026-40213, CVE-2026-40214 Affects ~~~~~~~ - Cyborg: >=3.0.0 <14.0.1, >=15.0.0 <15.0.1, >=16.0.0 <16.0.1 Description ~~~~~~~~~~~ Sean Mooney from Red Hat reported multiple access control vulnerabilities in OpenStack Cyborg. Default policy rules for device, deployable, and attribute API endpoints use an unconditional allow check that grants access to any authenticated user regardless of roles or project scope (CVE-2026-40213). Separately, Accelerator Request (ARQ) resources lack project ownership enforcement, allowing any authenticated user to enumerate, delete, or manipulate ARQs belonging to other projects (CVE-2026-40214). All Cyborg deployments are affected. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/cyborg/+/987698 (2025.1/epoxy) - https://review.opendev.org/c/openstack/cyborg/+/987699 (2025.1/epoxy) - https://review.opendev.org/c/openstack/cyborg/+/987700 (2025.1/epoxy) - https://review.opendev.org/c/openstack/cyborg/+/987701 (2025.1/epoxy) - https://review.opendev.org/c/openstack/cyborg/+/987702 (2025.1/epoxy) - https://review.opendev.org/c/openstack/cyborg/+/987703 (2025.1/epoxy) - https://review.opendev.org/c/openstack/cyborg/+/987692 (2025.2/flamingo) - https://review.opendev.org/c/openstack/cyborg/+/987693 (2025.2/flamingo) - https://review.opendev.org/c/openstack/cyborg/+/987694 (2025.2/flamingo) - https://review.opendev.org/c/openstack/cyborg/+/987695 (2025.2/flamingo) - https://review.opendev.org/c/openstack/cyborg/+/987696 (2025.2/flamingo) - https://review.opendev.org/c/openstack/cyborg/+/987697 (2025.2/flamingo) - https://review.opendev.org/c/openstack/cyborg/+/987687 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/cyborg/+/987688 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/cyborg/+/987689 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/cyborg/+/987690 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/cyborg/+/987691 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/cyborg/+/987680 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/cyborg/+/987681 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/cyborg/+/987682 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/cyborg/+/987683 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/cyborg/+/987684 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/cyborg/+/987685 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/cyborg/+/987686 (2026.2/hibiscus) Credits ~~~~~~~ - Sean Mooney from Red Hat (CVE-2026-40213, CVE-2026-40214) References ~~~~~~~~~~ - https://launchpad.net/bugs/2143263 - https://launchpad.net/bugs/2144056 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40213 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40214 Notes ~~~~~ - CVE-2026-40213 (policy bypass) affects versions 5.0.0 and later. CVE-2026-40214 (missing ownership) affects versions 3.0.0 and later. The affected-products range covers both. -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-010] Ironic: Credential Forwarding to Arbitrary Endpoints via iDrac Configuration Molds Feature (CVE-2026-42997)
by Jay Faulkner 06 May '26

06 May '26

========================================================================================================== OSSA-2026-010: Credential Forwarding to Arbitrary Endpoints via Ironic's idrac Configuration molds Feature ========================================================================================================== :Date: May 05, 2026 :CVE: CVE-2026-42997 Affects ~~~~~~~ - Ironic: >=17.0.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1 Description ~~~~~~~~~~~ Dmitry Tantsur and Tuomo Tanskanen from the Metal3.io Security Team reported a vulnerability in Ironic's configuration mold import code for idrac. When importing a configuration mold, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. Operators choose the URL and the attacker has to already be authenticated with permissions to execute clean/deploy steps, but the arbitrary URL for the authorization request is user-controlled and not validated by Ironic. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/986817 (2023.1/antelope (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/986816 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/986815 (2024.2/dalmatian) - https://review.opendev.org/c/openstack/ironic/+/986767 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/986737 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/986725 (2026.1/gazpacho) Credits ~~~~~~~ - Dmitry Tantsur from Metal3.io Security Team - Tuomo Tanskanen from Metal3.io Security Team References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2148317 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42997 Notes ~~~~~ - The molds feature was deprecated in the 2024.1 (Caracal) release and has been removed during development of the 2026.2 (Hibiscus) release.

1 0

[OSSA-2026-009] Horizon: Unauthenticated session flood via login redirect storage (CVE-2026-43002)
by Goutham Pacha Ravi 05 May '26

05 May '26

========================================================================= OSSA-2026-009: Unauthenticated session flood via login redirect storage ========================================================================= :Date: April 27, 2026 :CVE: CVE-2026-43002 Affects ~~~~~~~ - Horizon: >=25.6.0 <25.7.3 Description ~~~~~~~~~~~ Erichen (Institute of Computing Technology, Chinese Academy of Sciences) reported a denial of service vulnerability in Horizon. The login view stores a post-login redirect URL in the server-side session before the user authenticates. Because each unauthenticated request without a session cookie triggers a new persistent session entry, an attacker can exhaust the session storage backend (Memcached, Redis, or database) by sending repeated requests to ``/auth/login/?next=URL``. When the backend reaches capacity, legitimate sessions are evicted, logging out administrators and preventing them from accessing the dashboard. This is a regression of CVE-2014-8124. Deployments running Horizon from the 2026.1 (Gazpacho) release series with default session configuration are affected. Earlier release series do not contain the vulnerable code. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/horizon/+/986834 (2026.1/gazpacho) Credits ~~~~~~~ - Erichen from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-43002) References ~~~~~~~~~~ - https://launchpad.net/bugs/2150331 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43002 Notes ~~~~~ - This vulnerability was introduced in commit 3e2ff4e06 (Horizon 25.6.0) and only affects the 2026.1 (Gazpacho) release series. Earlier releases are not affected. - This is a regression of CVE-2014-8124. The original middleware-level fix remains effective, but the new view-layer session write bypasses it. -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0