OpenStack

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 5.4MediumOct 23, 2026OpenStack IronicCVE-2026-90458OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
• 5.0MediumOct 23, 2026OpenStack IronicCVE-2026-89419OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.
• 4.3MediumOct 23, 2026OpenStack Ironic Denial of serviceCVE-2026-115638OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
• 9.9CriticalOct 21, 2026OpenStack Manila Auth bypass / access controlCVE-2026-71195In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate acce

See every OpenStack entry on the dashboard.

Top products

• Ironic3 CVEs in the last year
• Manila1 CVE in the last year, 1 critical

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• oss-security · Oct 29, 2026[OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)CVE-2026-115638