Skip to content
Threat Feed
Subscribe

Tag

Openstack

4 briefs RSS
low advisory

OpenStack Ironic: Conductor denial-of-service via gzip bomb (CVE-2026-115638)

The OpenStack Ironic Conductor service is vulnerable to a denial-of-service attack due to improper handling of maliciously crafted compressed configuration drive files.

Ironic denial-of-service cloud openstack
1t 1c
medium advisory

OpenStack oslo.utils: Information exposure of LUKS key material

The oslo.utils library contains an information exposure vulnerability in its LUKS inspector that can result in sensitive cryptographic key material being written to system logs when processing LUKSv1 disk images.

oslo.utils openstack information-exposure log-security
high advisory

OpenStack Keystone LDAP Authentication Bypass Vulnerability (CVE-2026-40683)

OpenStack Keystone before 28.0.1 is vulnerable to an authentication bypass due to improper handling of the user enabled attribute in the LDAP identity backend when the user_enabled_invert configuration option is False, leading to disabled users being treated as enabled.

Keystone openstack ldap authentication-bypass
2r 3t 1c
high advisory

choieastsea simple-openstack-mcp OS Command Injection Vulnerability (CVE-2026-7066)

The choieastsea simple-openstack-mcp application is vulnerable to OS command injection via the exec_openstack function in server.py, allowing remote attackers to execute arbitrary commands.

simple-openstack-mcp command-injection vulnerability openstack
3r 1t 1c