OpenStack vulnerabilities

Products

• Keystone 49
• Nova 40
• Neutron 29
• folsom 25
• horizon 24
• Ironic 19
• Swift 19
• essex 15
• image registry and delivery service glance 15
• Glance 14
• grizzly 14
• compute 12
• havana 11
• cinder 10
• heat 7
• python-keystoneclient 7
• barbican 5
• keystonemiddleware 5
• Mistral 5
• Octavia 5
• tripleo heat templates 5
• Designate 4
• icehouse 4
• Ironic Python Agent 3
• Manila 3
• openstack 3
• trove 3
• Zaqar 3
• Blazar 2
• ceilometer 2

Latest OpenStack CVEs

Newest publication first · page 4 of 14

1. CVE-2024-40767 OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

   Published 2024-07-24

   Medium·CVSS 6.5 EPSS 0.95%

   In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of...

2. CVE-2024-32498 OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

   Published 2024-07-05

   Medium·CVSS 6.5 EPSS 0.84%

   An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convin...

3. CVE-2024-28716 An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.

   Published 2024-04-30

   High·CVSS 7.5 EPSS 1.4%

   An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.

4. CVE-2024-28717 OpenStack Storlets arbitrary code execution vulnerability

   Published 2024-04-22

   Medium·CVSS 4.9 EPSS 0.89%

   An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.

5. CVE-2024-28718 OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

   Published 2024-04-12

   Critical·CVSS 9.8 EPSS 1.1%

   An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component.

6. CVE-2024-29156 Information leakage in YAQL

   Published 2024-03-18

   Medium·CVSS 6.5 EPSS 0.75%

   In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

7. CVE-2024-1141 Glance-store: glance store access key logged in debug log level

   Published 2024-02-01

   Medium·CVSS 5.5 EPSS 0.23%

   A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.

8. CVE-2023-1633 Insecure barbican configuration file leaking credential

   Published 2023-09-24

   Medium·CVSS 5.5 EPSS 0.19%

   A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.

9. CVE-2023-1636 Incomplete container isolation

   Published 2023-09-24

   Medium·CVSS 5.0 EPSS 0.48%

   A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any...

10. CVE-2023-1625 Information leak in api

    Published 2023-09-24

    Medium·CVSS 5.0 EPSS 0.72%

    An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the...

11. CVE-2022-45582 Horizon Web Dashboard Open Redirect vulnerability

    Published 2023-08-22

    Medium·CVSS 6.1 EPSS 0.80%

    Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

12. CVE-2022-3101 tripleo-ansible may disclose important configuration details from an OpenStack deployment

    Published 2023-03-23

    Medium·CVSS 5.5 EPSS 0.20%

    A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information...

13. CVE-2022-3146 tripleo-ansible may disclose important configuration details from an OpenStack deployment

    Published 2023-03-23

    Medium·CVSS 5.5 EPSS 0.20%

    A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to in...

14. CVE-2022-3277 openstack-neutron uncontrolled resource consumption flaw

    Published 2023-03-06

    Medium·CVSS 6.5 EPSS 1.1%

    An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to s...

15. CVE-2022-4134 OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability

    Published 2023-03-06

    Low·CVSS 2.8 EPSS 0.33%

    A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.

16. CVE-2022-47951 OpenStack Cinder, glance, and Nova vulnerable to Path Traversal

    Published 2023-01-26

    Medium·CVSS 5.7 EPSS 1.1%

    An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific bac...

17. CVE-2022-3100 A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

    Published 2023-01-18

    Medium·CVSS 5.9 EPSS 0.45%

    A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

18. CVE-2022-47950 OpenStack Swift XML external entities (XXE) Injection

    Published 2023-01-18

    Medium·CVSS 6.5 EPSS 1.0%

    An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentiall...

19. CVE-2022-38065 A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within....

    Published 2022-12-21

    High·CVSS 8.8 EPSS 0.63%

    A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within a container can lead increased privileges.

20. CVE-2022-38060 OpenStack Kolla sudo privilege escalation vulnerability

    Published 2022-12-21

    High·CVSS 7.8 EPSS 0.22%

    A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.

21. CVE-2022-23451 Barbican authorization flaw before v14.0.0

    Published 2022-09-06

    High·CVSS 8.1 EPSS 1.3%

    An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete p...

22. CVE-2022-23452 openstack-barbican Denial of Service vulnerability

    Published 2022-09-01

    Medium·CVSS 4.9 EPSS 1.3%

    An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.

23. CVE-2022-2447 A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could a...

    Published 2022-09-01

    Medium·CVSS 6.6 EPSS 0.72%

    A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected...

24. CVE-2022-0718 python-oslo-utils has improper password parsing

    Published 2022-08-29

    Medium·CVSS 4.9 EPSS 1.9%

    A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.

25. CVE-2021-3585 A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.

    Published 2022-08-26

    Medium·CVSS 5.5 EPSS 0.25%

    A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.