OpenStack Keystone versions 13.0.0, 28.0.0, and 29.0.0 contain an authorization flaw where tokens obtained via delegated authentication can be used to bypass intended project scope boundaries. Specifically, application credential tokens without explicit scope are incorrectly reauthenticated and scoped to the credential owner's default project instead of the intended project. This affects all Keystone deployments that allow delegated authentication through OAuth1 access tokens, application credentials, or trusts.
CVE-2026-80182 is a high-severity authorization vulnerability in OpenStack Keystone before version 29.0.3. It allows tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication to create new long-lived credentials or authorize new delegations that persist independently and outlive the original credential. The vulnerability arises because delegation restrictions do not consistently apply to all delegated token types, enabling unauthorized creation of application credentials or OAuth1 request tokens. This affects all Keystone deployments that permit delegated authentication through these token types.
CVE-2026-77648 is a server-side request forgery (SSRF) vulnerability in OpenStack Glance affecting versions 30.0.0 through 32.0.0. It occurs in the /v2/tasks API when handling import tasks, allowing an admin user to fetch internal URLs within the Glance service network. This API is restricted to admin users and has been deprecated for several releases. The vulnerability has a low CVSS score of 2.2 and results in limited information disclosure without impacting confidentiality, integrity, or availability beyond that.
CVE-2026-76878 is a high-severity vulnerability in OpenStack Aodh before version 22.0.1 where the alarm list API improperly handles the all_projects query parameter. This flaw allows non-admin users with reader roles to bypass project scoping and list alarms from all projects, exposing sensitive information such as webhook URLs, Heat signal endpoints, project IDs, and user IDs. Additionally, OpenStack Watcher's webhook trigger endpoint lacks authorization controls since version 4.0.0, enabling any authenticated user who obtains a webhook URL to trigger audits and action plans regardless of their permissions.
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
CVE-2026-71201 is an authorization vulnerability in OpenStack Ironic up to version 38.0.0. It allows a project reader with limited privileges to craft a request that returns Portgroups assigned to Nodes owned or leased by other projects. The vulnerability has a medium severity with a CVSS score of 5. No official patch or remediation information is currently available.
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.
OpenStack Horizon versions before 25.7.4 have an issue where scripts generated for downloading OpenStack RC files may include project names containing shell metacharacters. This can lead to improper neutralization of special elements used in OS commands, classified as OS Command Injection (CWE-78). Some consider this more a security hardening opportunity than a direct vulnerability. The CVSS score is 6.0 (medium severity).