Vulnerability-Lookup

RHSA-2026:94039

Vulnerability from csaf_redhat - Published: 2026-11-02 19:17 - Updated: 2026-11-02 23:49

Summary

Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 security advisory

Severity

Important

Notes

Topic: Updated packages that resolve security issues are now available for Red Hat OpenStack Platform 13.0 for Red Hat Enterprise Linux (RHEL) 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware. Security Fix(es): * Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova (CVE-2026-24708) * OpenStack Nova: Resource allocation issue due to unstripped hint data in server creation API (CVE-2026-46448) * OpenStack Keystone: Privilege escalation through EC2 credential creation (CVE-2026-33551) * OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse (CVE-2026-43000) * python-webob: Open redirect vulnerability leading to phishing and token theft (CVE-2026-54770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-24708

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw disk and trigger destructive behavior during instance operations such as resize.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE-73 - External Control of File Name or Path

Affected products

Fixed 17 products

Product	Version	Remediation
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch	—	Vendor Fix fix Workaround

Known not affected 21 products

Product	Version	Remediation
Unresolved product id: 7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Workaround
Unresolved product id: 7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Workaround
Unresolved product id: 7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Workaround
Unresolved product id: 7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Workaround

Threats

Impact Important

CVE-2026-33551

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full set of the parent user's S3 permissions. This effectively bypasses the role restrictions imposed on the application credential, leading to unauthorized access and privilege escalation. This issue affects deployments that use restricted application credentials in combination with the EC2/S3 compatibility API.

3.5 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src	—	Vendor Fix fix
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch	—	Vendor Fix fix

Known not affected 35 products

Product	Identifier	Version	Remediation
Unresolved product id: 7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch		—
Unresolved product id: 7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src		—
Unresolved product id: 7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src		—
Unresolved product id: 7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch		—
Unresolved product id: 7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src		—
Unresolved product id: 7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch		—
Unresolved product id: 7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src		—

Threats

Impact Low

CVE-2026-43000

A flaw was found in OpenStack Keystone. An attacker with a member role on a project can escalate their privileges to an administrator role. This is achieved by combining an application credential impersonation vulnerability with the misuse of Keystone trusts. The system incorrectly validates delegated roles against the victim's actual database roles instead of the requesting token, allowing the attacker to create a trust that grants them the victim's administrative privileges. This trust can then be used to maintain persistent access.

8.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 3 products, the same list as for CVE-2026-33551

Known not affected 35 products, the same list as for CVE-2026-33551

Threats

Impact Important

CVE-2026-46448

A flaw was found in OpenStack Nova. The server creation application programming interface (API) fails to remove specific hint data, leading to instances being created without proper Placement allocation. This can result in a denial of service, as resources may not be correctly assigned or managed for the affected instances.

8.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

CWE-1173 - Improper Use of Validation Framework

Affected products

Fixed 17 products, the same list as for CVE-2026-24708

Known not affected 21 products, the same list as for CVE-2026-24708

Threats

Impact Important

CVE-2026-54770

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CWE-601 - URL Redirection to Untrusted Site

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: 7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src	—	Vendor Fix fix Workaround

Known not affected 30 products

Product	Version	Remediation
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch	—	Workaround
Unresolved product id: 7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src	—	Workaround

Threats

Impact Important

References

40 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:94039	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2430312	external
https://bugzilla.redhat.com/show_bug.cgi?id=2451037	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482826	external
https://bugzilla.redhat.com/show_bug.cgi?id=2489379	external
https://bugzilla.redhat.com/show_bug.cgi?id=2520616	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-24708	self
https://bugzilla.redhat.com/show_bug.cgi?id=2430312	external
https://www.cve.org/CVERecord?id=CVE-2026-24708	external
https://nvd.nist.gov/vuln/detail/CVE-2026-24708	external
https://bugs.launchpad.net/nova/+bug/2137507	external
https://access.redhat.com/security/cve/CVE-2026-33551	self
https://bugzilla.redhat.com/show_bug.cgi?id=2451037	external
https://www.cve.org/CVERecord?id=CVE-2026-33551	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33551	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://security.openstack.org/ossa/OSSA-2026-005.html	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-43000	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482826	external
https://www.cve.org/CVERecord?id=CVE-2026-43000	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43000	external
https://bugs.launchpad.net/keystone/+bug/2148477	external
https://security.openstack.org/ossa/OSSA-2026-015.html	external
https://access.redhat.com/security/cve/CVE-2026-46448	self
https://bugzilla.redhat.com/show_bug.cgi?id=2489379	external
https://www.cve.org/CVERecord?id=CVE-2026-46448	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46448	external
http://www.openwall.com/lists/oss-security/2026/06/16/5	external
https://bugs.launchpad.net/nova/+bug/2151252	external
https://www.openwall.com/lists/oss-security/2026/…	external
https://access.redhat.com/security/cve/CVE-2026-54770	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520616	external
https://www.cve.org/CVERecord?id=CVE-2026-54770	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54770	external
https://github.com/Pylons/webob/commit/ff89560643…	external
https://github.com/Pylons/webob/security/advisori…	external
https://github.com/Pylons/webob/tree/1.8.11	external

Acknowledgments

RedHat Dan Smith

Orange Cyberdefense CERT Vulnerability Intelligence Watch Team Maxence Bornecque

Institute of Computing Technology, Chinese Academy of Sciences Erichen

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated packages that resolve security issues are now available for Red Hat OpenStack Platform 13.0 for Red Hat Enterprise Linux (RHEL) 7.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.\n\nSecurity Fix(es):\n\n* Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling\nin OpenStack Nova (CVE-2026-24708)\n\n* OpenStack Nova: Resource allocation issue due to unstripped hint data in\nserver creation API (CVE-2026-46448)\n\n* OpenStack Keystone: Privilege escalation through EC2 credential creation\n(CVE-2026-33551)\n\n* OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse (CVE-2026-43000)\n\n* python-webob: Open redirect vulnerability leading to phishing and token theft (CVE-2026-54770)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:94039",
        "url": "https://access.redhat.com/errata/RHSA-2026:94039"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2430312",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430312"
      },
      {
        "category": "external",
        "summary": "2451037",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451037"
      },
      {
        "category": "external",
        "summary": "2482826",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482826"
      },
      {
        "category": "external",
        "summary": "2489379",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489379"
      },
      {
        "category": "external",
        "summary": "2520616",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520616"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94039.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 security advisory",
    "tracking": {
      "current_release_date": "2026-11-02T23:49:55+00:00",
      "generator": {
        "date": "2026-11-02T23:49:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:94039",
      "initial_release_date": "2026-11-02T19:17:15+00:00",
      "revision_history": [
        {
          "date": "2026-11-02T19:17:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-02T19:17:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-02T23:49:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 13.0 - ELS",
                "product": {
                  "name": "Red Hat OpenStack Platform 13.0 - ELS",
                  "product_id": "7Server-RH7-RHOS-13.0-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:13::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 13.0 - ELS",
                "product": {
                  "name": "Red Hat OpenStack Platform 13.0 - ELS",
                  "product_id": "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:13::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 13.0 - ELS",
                "product": {
                  "name": "Red Hat OpenStack Platform 13.0 - ELS",
                  "product_id": "7Client-RH7-RHOS-TOOLS-13.0-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:13::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 13.0 - ELS",
                "product": {
                  "name": "Red Hat OpenStack Platform 13.0 - ELS",
                  "product_id": "7Server-RH7-RHOS-TOOLS-13.0-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:13::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 13.0 - ELS",
                "product": {
                  "name": "Red Hat OpenStack Platform 13.0 - ELS",
                  "product_id": "7Workstation-RH7-RHOS-TOOLS-13.0-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:13::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-heat-1:10.0.3-21.el7ost.src",
                "product": {
                  "name": "openstack-heat-1:10.0.3-21.el7ost.src",
                  "product_id": "openstack-heat-1:10.0.3-21.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-heat@10.0.3-21.el7ost?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
                "product": {
                  "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
                  "product_id": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/puppet-heat@12.4.1-0.20200413050251.d61d033.el7ost?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-keystone-1:13.0.4-10.el7ost.src",
                "product": {
                  "name": "openstack-keystone-1:13.0.4-10.el7ost.src",
                  "product_id": "openstack-keystone-1:13.0.4-10.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-keystone@13.0.4-10.el7ost?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-1:17.0.13-43.el7ost.src",
                "product": {
                  "name": "openstack-nova-1:17.0.13-43.el7ost.src",
                  "product_id": "openstack-nova-1:17.0.13-43.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova@17.0.13-43.el7ost?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-webob-0:1.7.2-2.el7ost.src",
                "product": {
                  "name": "python-webob-0:1.7.2-2.el7ost.src",
                  "product_id": "python-webob-0:1.7.2-2.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-webob@1.7.2-2.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-heat-api-1:10.0.3-21.el7ost.noarch",
                "product": {
                  "name": "openstack-heat-api-1:10.0.3-21.el7ost.noarch",
                  "product_id": "openstack-heat-api-1:10.0.3-21.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-heat-api@10.0.3-21.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
                "product": {
                  "name": "openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
                  "product_id": "openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-heat-api-cfn@10.0.3-21.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-heat-common-1:10.0.3-21.el7ost.noarch",
                "product": {
                  "name": "openstack-heat-common-1:10.0.3-21.el7ost.noarch",
                  "product_id": "openstack-heat-common-1:10.0.3-21.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-heat-common@10.0.3-21.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
                "product": {
                  "name": "openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
                  "product_id": "openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-heat-engine@10.0.3-21.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
                "product": {
                  "name": "openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
                  "product_id": "openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-heat-monolith@10.0.3-21.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
                "product": {
                  "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
                  "product_id": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/puppet-heat@12.4.1-0.20200413050251.d61d033.el7ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-keystone-1:13.0.4-10.el7ost.noarch",
                "product": {
                  "name": "openstack-keystone-1:13.0.4-10.el7ost.noarch",
                  "product_id": "openstack-keystone-1:13.0.4-10.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-keystone@13.0.4-10.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-keystone-1:13.0.4-10.el7ost.noarch",
                "product": {
                  "name": "python-keystone-1:13.0.4-10.el7ost.noarch",
                  "product_id": "python-keystone-1:13.0.4-10.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-keystone@13.0.4-10.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-api-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-api-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-api-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-api@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-cells@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-common-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-common-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-common-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-common@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-compute@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-conductor@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-console-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-console-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-console-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-console@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-migration@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-network-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-network-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-network-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-network@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-novncproxy@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-placement-api@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-scheduler@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-serialproxy@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
                  "product_id": "openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-spicehtml5proxy@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-nova-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "python-nova-1:17.0.13-43.el7ost.noarch",
                  "product_id": "python-nova-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-nova@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-nova-tests-1:17.0.13-43.el7ost.noarch",
                "product": {
                  "name": "python-nova-tests-1:17.0.13-43.el7ost.noarch",
                  "product_id": "python-nova-tests-1:17.0.13-43.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-nova-tests@17.0.13-43.el7ost?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-webob-0:1.7.2-2.el7ost.noarch",
                "product": {
                  "name": "python-webob-0:1.7.2-2.el7ost.noarch",
                  "product_id": "python-webob-0:1.7.2-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-webob@1.7.2-2.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.noarch",
        "relates_to_product_reference": "7Client-RH7-RHOS-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.src",
        "relates_to_product_reference": "7Client-RH7-RHOS-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-heat-1:10.0.3-21.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src"
        },
        "product_reference": "openstack-heat-1:10.0.3-21.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-heat-api-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch"
        },
        "product_reference": "openstack-heat-api-1:10.0.3-21.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch"
        },
        "product_reference": "openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-heat-common-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch"
        },
        "product_reference": "openstack-heat-common-1:10.0.3-21.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-heat-engine-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch"
        },
        "product_reference": "openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-heat-monolith-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch"
        },
        "product_reference": "openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-keystone-1:13.0.4-10.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch"
        },
        "product_reference": "openstack-keystone-1:13.0.4-10.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-keystone-1:13.0.4-10.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src"
        },
        "product_reference": "openstack-keystone-1:13.0.4-10.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-1:17.0.13-43.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src"
        },
        "product_reference": "openstack-nova-1:17.0.13-43.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-api-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-api-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-cells-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-common-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-common-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-compute-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-conductor-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-console-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-console-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-migration-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-network-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-network-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch"
        },
        "product_reference": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src"
        },
        "product_reference": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-keystone-1:13.0.4-10.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch"
        },
        "product_reference": "python-keystone-1:13.0.4-10.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-nova-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "python-nova-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-nova-tests-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch"
        },
        "product_reference": "python-nova-tests-1:17.0.13-43.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch"
        },
        "product_reference": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src"
        },
        "product_reference": "puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.noarch",
        "relates_to_product_reference": "7Workstation-RH7-RHOS-TOOLS-13.0-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-webob-0:1.7.2-2.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS",
          "product_id": "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        },
        "product_reference": "python-webob-0:1.7.2-2.el7ost.src",
        "relates_to_product_reference": "7Workstation-RH7-RHOS-TOOLS-13.0-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dan Smith"
          ],
          "organization": "RedHat"
        }
      ],
      "cve": "CVE-2026-24708",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-01-16T06:29:23.249000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2430312"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in OpenStack Nova\u2019s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw disk and trigger destructive behavior during instance operations such as resize.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat OpenStack Platform. An authenticated attacker can exploit unconstrained disk format handling in OpenStack Nova when invoking qemu-img. By crafting a QCOW2 header on an ephemeral or root disk, an attacker can cause qemu-img to overwrite arbitrary files on the compute host with Nova\u0027s write access, leading to data destruction or denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch"
        ],
        "known_not_affected": [
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24708"
        },
        {
          "category": "external",
          "summary": "RHBZ#2430312",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430312"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24708",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24708"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24708",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24708"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/nova/+bug/2137507",
          "url": "https://bugs.launchpad.net/nova/+bug/2137507"
        }
      ],
      "release_date": "2026-02-17T15:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T19:17:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94039"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Maxence Bornecque"
          ],
          "organization": "Orange Cyberdefense CERT Vulnerability Intelligence Watch Team"
        }
      ],
      "cve": "CVE-2026-33551",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-03-24T23:40:47.060000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full set of the parent user\u0027s S3 permissions. This effectively bypasses the role restrictions imposed on the application credential, leading to unauthorized access and privilege escalation. This issue affects deployments that use restricted application credentials in combination with the EC2/S3 compatibility API.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch"
        ],
        "known_not_affected": [
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33551"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33551",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33551"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33551",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33551"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/07/12",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/07/12"
        },
        {
          "category": "external",
          "summary": "https://security.openstack.org/ossa/OSSA-2026-005.html",
          "url": "https://security.openstack.org/ossa/OSSA-2026-005.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/07/12",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/07/12"
        }
      ],
      "release_date": "2026-04-07T15:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T19:17:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94039"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation"
    },
    {
      "cve": "CVE-2026-43000",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-05-28T19:01:11.777810+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2482826"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenStack Keystone. An attacker with a member role on a project can escalate their privileges to an administrator role. This is achieved by combining an application credential impersonation vulnerability with the misuse of Keystone trusts. The system incorrectly validates delegated roles against the victim\u0027s actual database roles instead of the requesting token, allowing the attacker to create a trust that grants them the victim\u0027s administrative privileges. This trust can then be used to maintain persistent access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keystone: OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This IMPORTANT privilege escalation in Keystone allows project members to gain admin access by chaining application credential impersonation with trust exploitation. High complexity is required (multiple vulnerability chain). The scope is changed as the attacker gains persistent admin access affecting other users. Impact is high to confidentiality and integrity. Affects versions before 29.0.2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch"
        ],
        "known_not_affected": [
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43000"
        },
        {
          "category": "external",
          "summary": "RHBZ#2482826",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482826"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43000",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43000"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43000",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43000"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/keystone/+bug/2148477",
          "url": "https://bugs.launchpad.net/keystone/+bug/2148477"
        },
        {
          "category": "external",
          "summary": "https://security.openstack.org/ossa/OSSA-2026-015.html",
          "url": "https://security.openstack.org/ossa/OSSA-2026-015.html"
        }
      ],
      "release_date": "2026-05-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T19:17:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94039"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keystone: OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Erichen"
          ],
          "organization": "Institute of Computing Technology, Chinese Academy of Sciences",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-46448",
      "cwe": {
        "id": "CWE-1173",
        "name": "Improper Use of Validation Framework"
      },
      "discovery_date": "2026-06-16T20:01:35.958658+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489379"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenStack Nova. The server creation application programming interface (API) fails to remove specific hint data, leading to instances being created without proper Placement allocation. This can result in a denial of service, as resources may not be correctly assigned or managed for the affected instances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-nova: OpenStack Nova: Resource allocation issue due to unstripped hint data in server creation API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform (RHOSP) 16.2, 17.1, and 18.0 ship affected versions of openstack-nova and are vulnerable to this flaw. The vulnerability requires authenticated access as a project member (the default \u0027member\u0027 role is sufficient to create servers). The Nova API is typically network-accessible within the OpenStack deployment. Exploitation requires no special configuration or admin privileges beyond standard project membership.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch"
        ],
        "known_not_affected": [
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46448"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489379",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489379"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46448",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46448"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46448",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46448"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/06/16/5",
          "url": "http://www.openwall.com/lists/oss-security/2026/06/16/5"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/nova/+bug/2151252",
          "url": "https://bugs.launchpad.net/nova/+bug/2151252"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/06/16/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/06/16/5"
        }
      ],
      "release_date": "2026-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T19:17:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94039"
        },
        {
          "category": "workaround",
          "details": "There is no configuration option to restrict which scheduler hint keys users can supply. However, operators can reduce the attack surface by:\n\n1. Restricting access to the Nova API via network segmentation (firewall rules limiting which networks can reach the Nova API endpoint).\n2. Using Keystone application credentials with limited scope to restrict which users can create servers.\n\nThese mitigations reduce exposure but do not fully prevent exploitation.",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openstack-nova: OpenStack Nova: Resource allocation issue due to unstripped hint data in server creation API"
    },
    {
      "cve": "CVE-2026-54770",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site"
      },
      "discovery_date": "2026-08-20T16:52:08.382509+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users to malicious websites for phishing or to steal OAuth and Single Sign-On (SSO) tokens. Exploitation requires the user to follow the crafted redirect.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an open redirect vulnerability in the WebOb library. An unauthenticated attacker can craft a malicious URL that, when processed by applications utilizing WebOb for redirects, bypasses URL validation. This could lead to users being redirected to attacker-controlled sites, facilitating phishing attacks or the theft of authentication tokens, provided the user follows the redirect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
          "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
        ],
        "known_not_affected": [
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
          "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
          "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
          "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
          "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
        },
        {
          "category": "external",
          "summary": "https://github.com/Pylons/webob/tree/1.8.11",
          "url": "https://github.com/Pylons/webob/tree/1.8.11"
        }
      ],
      "release_date": "2026-08-20T16:31:46.791000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T19:17:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94039"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present.",
          "product_ids": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Client-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-1:10.0.3-21.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-common-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-engine-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-heat-monolith-1:10.0.3-21.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-keystone-1:13.0.4-10.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-1:17.0.13-43.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-cells-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-common-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-compute-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-conductor-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-console-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-migration-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-network-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-13.0-ELS:python-keystone-1:13.0.4-10.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-nova-tests-1:17.0.13-43.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch",
            "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0-ELS:puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Server-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.noarch",
            "7Workstation-RH7-RHOS-TOOLS-13.0-ELS:python-webob-0:1.7.2-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft"
    }
  ]
}

CVE-2026-24708 (GCVE-0-2026-24708)

Vulnerability from cvelistv5 – Published: 2026-02-18 00:00 – Updated: 2026-09-11 12:09

Summary

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-19 19:07 UTC

CWE

CWE-669 - Incorrect Resource Transfer Between Spheres
CWE-73 - External Control of File Name or Path

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2251 records in the last 180 days details

References

9 references

URL	Tags
https://bugs.launchpad.net/nova/+bug/2137507
https://www.openwall.com/lists/oss-security/2026/…
https://lists.debian.org/debian-lts-announce/2026…
https://access.redhat.com/security/cve/CVE-2026-24708	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2430312	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:54757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66401	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7884	vendor-advisoryx_refsource_REDHAT

Impacted products

34 products

Vendor	Product	Version
OpenStack	Nova	Affected: 0 , < 30.2.2 (semver) Affected: 31.0.0 , < 31.2.1 (semver) Affected: 32.0.0 , < 32.1.1 (semver) cpe:2.3:a:openstack:nova:::::::: cpe:2.3:a:openstack:nova:::::::: cpe:2.3:a:openstack:nova::::::::
Red Hat	Red Hat OpenStack Platform 16.2	Unaffected: 1:20.6.2-2.20260317135026.8a24acd.el8ost , < * (rpm) cpe:/a:redhat:openstack:16.2::el8
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:1.2.0-1.4.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:1.9.1-17.1.20260318160829.0e9a6f2.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:0.2.1-6.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:24.3.4.2-7.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:3.4.26-9.6.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:17.1-20260901.1.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:18.2.2-17.1.20260702111621.f6b44fc.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:16.1.1-17.1.20260713101101.edc6d60.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:17.1.1-17.1.20260721220909.c31db88.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:7.1.1-17.1.20260803104219.0211fa9.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:19.0.2-17.1.20260630150819.54dd95d.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:18.6.1-17.1.20260810120959.85ff760.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:23.2.3-17.1.20260810140853.2ace99d.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:0.8.37-17.1.20260107141051.05dd1b2.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:2.27.1-17.1.20260806131309.16dbcae.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:14.3.1-17.1.20260803105013.e7c7ce3.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:14.2.1-17.1.20260803103231.61d7bd7.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:11.0.1-17.1.20260306080955.63fee2c.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:14.2.3-17.1.20260206090839.40278e1.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:1.8.0-17.1.20260114160833.0e94611.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 1:19.4.1-17.1.20260630130603.9b1a13e.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:2.5.1-17.1.20260225150839.5f1cee6.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:4.3.4-17.1.20260324150947.cf69f92.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:12.7.3-17.1.20260701150916.5d6fd1a.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:4.1.1-17.1.20260326121047.bbe5d5a.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:1.9.4-17.1.20260304101059.65d02f0.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	Unaffected: 0:3.3.1-17.1.20260603190918.8debef3.el9ost , < * (rpm) cpe:/a:redhat:openstack:17.1::el9
Red Hat	Red Hat OpenStack Services on OpenShift 18.0	Unaffected: 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost , < * (rpm) cpe:/a:redhat:openstack:18.0::el9
Red Hat	Red Hat OpenStack Platform 13 (Queens)	cpe:/a:redhat:openstack:13
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24708",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-19T19:07:53.345297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-19T19:08:07.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-21T04:31:45.294Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-nova",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:20.6.2-2.20260317135026.8a24acd.el8ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-collection-ansible-posix",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.2.0-1.4.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-collections-openstack",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.9.1-17.1.20260318160829.0e9a6f2.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "collectd-sensubility",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.2.1-6.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:24.3.4.2-7.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "etcd",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.4.26-9.6.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "octavia-amphora-image-fips-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "octavia-amphora-image-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-cinder",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:18.2.2-17.1.20260702111621.f6b44fc.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-heat",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:16.1.1-17.1.20260713101101.edc6d60.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-ironic",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:17.1.1-17.1.20260721220909.c31db88.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-ironic-python-agent",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.1.1-17.1.20260803104219.0211fa9.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-keystone",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:19.0.2-17.1.20260630150819.54dd95d.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-neutron",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:18.6.1-17.1.20260810120959.85ff760.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-nova",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:23.2.3-17.1.20260810140853.2ace99d.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-selinux",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.8.37-17.1.20260107141051.05dd1b2.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-swift",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.27.1-17.1.20260806131309.16dbcae.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-tripleo-heat-templates",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:14.3.1-17.1.20260803105013.e7c7ce3.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "os-net-config",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:14.2.1-17.1.20260803103231.61d7bd7.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "puppet-rabbitmq",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:11.0.1-17.1.20260306080955.63fee2c.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "puppet-tripleo",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:14.2.3-17.1.20260206090839.40278e1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-cinder-tests-tempest",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.8.0-17.1.20260114160833.0e94611.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-django-horizon",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:19.4.1-17.1.20260630130603.9b1a13e.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-glance-store",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.1-17.1.20260225150839.5f1cee6.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-os-brick",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.3.4-17.1.20260324150947.cf69f92.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-oslo-messaging",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:12.7.3-17.1.20260701150916.5d6fd1a.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-oslo-serialization",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.1-17.1.20260326121047.bbe5d5a.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "python-ovsdbapp",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.9.4-17.1.20260304101059.65d02f0.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-fips-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-ipa-fips-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-ipa-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-minimal",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-minimal-fips",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-multirhel-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-uefi-fips-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-uefi-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-director-images-x86_64",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:17.1-20260901.1.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "tripleo-ansible",
            "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.3.1-17.1.20260603190918.8debef3.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-nova",
            "product": "Red Hat OpenStack Services on OpenShift 18.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:27.5.2-18.0.20260312122217.c1c6d67.el9ost",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:13"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp13/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 13 (Queens)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp12/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel8/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel9/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp12/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel8/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel9/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoso/openstack-nova-compute-rhel9",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp12/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel9/openstack-nova-compute",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-02-17T15:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw in OpenStack Nova\u2019s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw disk and trigger destructive behavior during instance operations such as resize."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-73",
                "description": "External Control of File Name or Path",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T12:09:05.112Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-24708"
          },
          {
            "name": "RHBZ#2430312",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430312"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54757"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66401"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:7884"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66401: Red Hat OpenStack Platform 17.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:7884: Red Hat OpenStack Services on OpenShift 18.0"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-01-16T06:29:23.249Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-17T15:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nova",
          "vendor": "OpenStack",
          "versions": [
            {
              "lessThan": "30.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "31.2.1",
              "status": "affected",
              "version": "31.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "32.1.1",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "30.2.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "31.2.1",
                  "versionStartIncluding": "31.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "32.1.1",
                  "versionStartIncluding": "32.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova\u0027s Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "CWE-669 Incorrect Resource Transfer Between Spheres",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T17:03:53.469Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bugs.launchpad.net/nova/+bug/2137507"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/02/17/7"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24708",
    "datePublished": "2026-02-18T00:00:00.000Z",
    "dateReserved": "2026-01-24T00:00:00.000Z",
    "dateUpdated": "2026-09-11T12:09:05.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33551 (GCVE-0-2026-33551)

Vulnerability from cvelistv5 – Published: 2026-04-10 00:00 – Updated: 2026-04-10 13:50

Summary

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-10 13:50 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2251 records in the last 180 days details

References

3 references

URL	Tags
https://bugs.launchpad.net/keystone/+bug/2142138
https://security.openstack.org/ossa/OSSA-2026-005.html
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
OpenStack	Keystone	Affected: 14.0.0 , < 26.1.1 (semver) Affected: 27.0.0 (semver) Affected: 28.0.0 (semver) Affected: 29.0.0 (semver) cpe:2.3:a:openstack:keystone:::::::: cpe:2.3:a:openstack:keystone:::::::: cpe:2.3:a:openstack:keystone:::::::: cpe:2.3:a:openstack:keystone::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-10T03:07:01.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/07/12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33551",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T13:50:09.231560Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T13:50:43.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://bugs.launchpad.net/keystone/+bug/2142138"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Keystone",
          "vendor": "OpenStack",
          "versions": [
            {
              "lessThan": "26.1.1",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "27.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "28.0.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "29.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.1.1",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "27.0.0",
                  "versionStartIncluding": "27.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "28.0.0",
                  "versionStartIncluding": "28.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "29.0.0",
                  "versionStartIncluding": "29.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user\u0027s S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-10T02:02:56.184Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bugs.launchpad.net/keystone/+bug/2142138"
        },
        {
          "url": "https://security.openstack.org/ossa/OSSA-2026-005.html"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-33551",
    "datePublished": "2026-04-10T00:00:00.000Z",
    "dateReserved": "2026-03-22T00:00:00.000Z",
    "dateUpdated": "2026-04-10T13:50:43.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43000 (GCVE-0-2026-43000)

Vulnerability from cvelistv5 – Published: 2026-05-28 00:00 – Updated: 2026-07-24 12:05

Summary

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

Severity

6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 19:41 UTC

CWE

CWE-863 - Incorrect Authorization
CWE-266 - Incorrect Privilege Assignment

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2251 records in the last 180 days details

References

5 references

URL	Tags
https://bugs.launchpad.net/keystone/+bug/2148477
https://security.openstack.org/ossa/OSSA-2026-015.html
https://access.redhat.com/security/cve/CVE-2026-43000	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2482826	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

5 products

Vendor	Product	Version
OpenStack	Keystone	Affected: 14.0.0 , < 27.0.2 (semver) Affected: 28.0.0 , < 28.0.2 (semver) Affected: 29.0.0 , < 29.0.2 (semver) cpe:2.3:a:openstack:keystone:::::::: cpe:2.3:a:openstack:keystone:::::::: cpe:2.3:a:openstack:keystone::::::::
Red Hat	Red Hat OpenStack Platform 13 (Queens)	cpe:/a:redhat:openstack:13
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T19:41:32.071988Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T19:41:55.135Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:13"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-keystone",
            "product": "Red Hat OpenStack Platform 13 (Queens)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:13"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp13/openstack-keystone",
            "product": "Red Hat OpenStack Platform 13 (Queens)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-keystone",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel8/openstack-keystone",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-keystone",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosp-rhel9/openstack-keystone",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "openstack-keystone",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoso/openstack-keystone-rhel9",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-28T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in OpenStack Keystone. An attacker with a member role on a project can escalate their privileges to an administrator role. This is achieved by combining an application credential impersonation vulnerability with the misuse of Keystone trusts. The system incorrectly validates delegated roles against the victim\u0027s actual database roles instead of the requesting token, allowing the attacker to create a trust that grants them the victim\u0027s administrative privileges. This trust can then be used to maintain persistent access."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-266",
                "description": "Incorrect Privilege Assignment",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T12:05:28.766Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43000"
          },
          {
            "name": "RHBZ#2482826",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482826"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43000.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-28T19:01:11.777Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-28T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "keystone: OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Keystone",
          "vendor": "OpenStack",
          "versions": [
            {
              "lessThan": "27.0.2",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "28.0.2",
              "status": "affected",
              "version": "28.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "29.0.2",
              "status": "affected",
              "version": "29.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.0.2",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.0.2",
                  "versionStartIncluding": "28.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim\u0027s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim\u0027s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim\u0027s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim\u0027s identity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T18:33:17.672Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bugs.launchpad.net/keystone/+bug/2148477"
        },
        {
          "url": "https://security.openstack.org/ossa/OSSA-2026-015.html"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-43000",
    "datePublished": "2026-05-28T00:00:00.000Z",
    "dateReserved": "2026-05-01T00:00:00.000Z",
    "dateUpdated": "2026-07-24T12:05:28.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46448 (GCVE-0-2026-46448)

Vulnerability from cvelistv5 – Published: 2026-06-16 00:00 – Updated: 2026-06-17 12:17

Summary

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 12:17 UTC

CWE

CWE-669 - Incorrect Resource Transfer Between Spheres

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2251 records in the last 180 days details

References

3 references

URL	Tags
https://bugs.launchpad.net/nova/+bug/2151252
https://www.openwall.com/lists/oss-security/2026/…
http://www.openwall.com/lists/oss-security/2026/06/16/5

Impacted products

1 product

Vendor	Product	Version
OpenStack	Nova	Affected: 18.0.0 , < 31.3.1 (semver) Affected: 32.0.0 , < 32.2.1 (semver) Affected: 33.0.0 , < 33.0.2 (semver) cpe:2.3:a:openstack:nova:::::::: cpe:2.3:a:openstack:nova:::::::: cpe:2.3:a:openstack:nova::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:16:38.300Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/16/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46448",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T12:17:00.108810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T12:17:30.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://bugs.launchpad.net/nova/+bug/2151252"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nova",
          "vendor": "OpenStack",
          "versions": [
            {
              "lessThan": "31.3.1",
              "status": "affected",
              "version": "18.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "32.2.1",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "33.0.2",
              "status": "affected",
              "version": "33.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "31.3.1",
                  "versionStartIncluding": "18.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "32.2.1",
                  "versionStartIncluding": "32.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "33.0.2",
                  "versionStartIncluding": "33.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "CWE-669 Incorrect Resource Transfer Between Spheres",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T19:06:32.026Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bugs.launchpad.net/nova/+bug/2151252"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/06/16/5"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-46448",
    "datePublished": "2026-06-16T00:00:00.000Z",
    "dateReserved": "2026-05-14T00:00:00.000Z",
    "dateUpdated": "2026-06-17T12:17:30.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54770 (GCVE-0-2026-54770)

Vulnerability from cvelistv5 – Published: 2026-08-20 16:31 – Updated: 2026-08-25 15:04

Title

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:03 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7904 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Pylons/webob/security/advisori…	x_refsource_CONFIRM
https://github.com/Pylons/webob/commit/ff89560643…	x_refsource_MISC
https://github.com/Pylons/webob/tree/1.8.11	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Pylons	webob	Affected: < 1.8.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54770",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:03:54.011941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:04:18.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "webob",
          "vendor": "Pylons",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(\"//\") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application\u0027s redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T16:31:46.791Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
        },
        {
          "name": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
        },
        {
          "name": "https://github.com/Pylons/webob/tree/1.8.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/webob/tree/1.8.11"
        }
      ],
      "source": {
        "advisory": "GHSA-6hx8-3wjj-gr8g",
        "discovery": "UNKNOWN"
      },
      "title": "WebOb: Open redirect in Location header normalization via leading C0 control / space characters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54770",
    "datePublished": "2026-08-20T16:31:46.791Z",
    "dateReserved": "2026-06-15T23:23:57.713Z",
    "dateUpdated": "2026-08-25T15:04:18.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:94039

CVE-2026-24708 (GCVE-0-2026-24708)

CVE-2026-33551 (GCVE-0-2026-33551)

CVE-2026-43000 (GCVE-0-2026-43000)

CVE-2026-46448 (GCVE-0-2026-46448)

CVE-2026-54770 (GCVE-0-2026-54770)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour