Red Hat Security Advisory

RHSA-2026:94039

Red Hat OpenStack Platform 13.0 security advisory

Released 2026-11-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenStack Platform 13.0 - ELS openstack-keystone-1:13.0.4-10.el7ost, openstack-nova-1:17.0.13-43.el7ost, openstack-nova-api-1:17.0.13-43.el7ost +16

TI-2026-34154 CVE-2026-46448 · GHSA-mfg3-p6m3-gjgr

HIGH 70

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00272 Published 2026-06-16 Partial fix · 31.3.1, 32.2.1 +1 CWE-669

TI-2026-39576 CVE-2026-54770 · GHSA-6hx8-3wjj-gr8g

MEDIUM 60

WebOb provides objects for HTTP requests and responses.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00421 Published 2026-08-20 Partial fix · 1.8.11 CWE-601

TI-2026-25942 CVE-2026-33551 · GHSA-4phw-6824-6cfp

MEDIUM 57

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-04-10 Fixed in 26.1.1 CWE-863

TI-2026-31180 CVE-2026-43000 · GHSA-q623-f4j4-p4xj

LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00328 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863

TI-2026-19922 CVE-2026-24708 · GHSA-m4f3-qp2w-gwh6

LOW 36

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00416 Published 2026-02-18 Partial fix · 30.2.2, 31.2.1 +1 CWE-669