These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A low-severity vulnerability was discovered in OpenStack Keystone, affecting versions 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. The issue allows an authenticated user with only a reader role to create EC2 credentials using a restricted application credential, potentially bypassing role restrictions.
CVE-2026-34881 is a Server-Side Request Forgery (SSRF) vulnerability in OpenStack Glance. An authenticated user can bypass URL validation checks using HTTP redirects, potentially accessing internal services. This issue affects the glance image import functionality, specifically the web-download and glance-download import methods, as well as the optional ovf_process image import plugin. The vulnerability h [truncated]
CVE-2026-24708 is a high-severity vulnerability in OpenStack Nova's Flat image backend that allows a user to perform an unsafe image resize operation, potentially destroying data on the host system. This issue arises when a malicious QCOW header is written to a root or ephemeral disk and a resize operation is triggered, causing Nova to call qemu-img without proper format restrictions. Only compute nodes u [truncated]
A critical vulnerability was discovered in OpenStack keystonemiddleware versions 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens, allowing an authenticated attacker to escalate privileges or impersonate other users by sending forged [truncated]
CVE-2016-5737 is a cross-site scripting issue in OpenStack's puppet-gerrit configuration. The problem is that text/html is incorrectly marked as a safe mimetype, which can let a crafted review render as active HTML in a user's browser. The issue was publicly recorded by NVD on 2017-01-12, with a patch reference already available in the upstream commit and oss-security disclosure referenced by the CVE record.