Report feedback

An authenticated remote attacker using the Amphora driver of Octavia can, via encryption settings, execute arbitrary code with root privileges, steal TLS keys of other tenants and penetrate the management network [1].

The vulnerability is present in product:

• OpenStack Octavia; >=6.0.0, <16.1.0; >=17.0.0, <17.0.1; >=18.0.0, <18.0.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

More information:

• CVE-2026-94572 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 21. 9. 2026.

An authenticated remote attacker using the Amphora driver of Octavia can, via redirect rules, execute arbitrary code with root privileges, steal TLS keys of other tenants and penetrate the management network [1].

The vulnerability is present in product:

• OpenStack Octavia; >=0.8.0, <16.1.0; >=17.0.0, <17.0.1; >=18.0.0, <18.0.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

More information:

• CVE-2026-94571 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 21. 9. 2026.

An unauthenticated remote attacker who knows the UUID of the target project can bypass authentication by sending an empty HTTP header and gain full access to the queues and messages of that project in the Zaqar service, and in deployments with admin_mode also to administrator operations. Only deployments using the WSGI transport with authentication configured are vulnerable [2].

The vulnerability is present in product:

• OpenStack Zaqar; >=1.0.0, <20.1.2; >=21.0.0, <21.0.2; >=22.0.0, <22.0.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2026-97404 at cve.org, NVD
• CWE-348: Use of Less Trusted Source at cwe.mitre.org

The vulnerability was publicly disclosed 24. 9. 2026.

An authenticated remote attacker who knows a resource reservation (lease) ID can modify or delete reservations of other users and projects when using the V2 lease API of the Blazar service [3].

The vulnerability is present in product:

• OpenStack Blazar; >=1.0.0, <15.1.1; >=16.0.0, <16.0.1; >=17.0.0, <17.0.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2026-93854 at cve.org, NVD
• CWE-1025: Comparison Using Wrong Factors at cwe.mitre.org

The vulnerability was publicly disclosed 18. 9. 2026.

An authenticated remote attacker using the V2 lease API of the Blazar service can list resource reservations (leases) of all projects, including their identifiers and metadata. The obtained lease IDs enable exploitation of CVE-2026-93854 [3].

The vulnerability is present in product:

• OpenStack Blazar; >=1.0.0, <15.1.1; >=16.0.0, <16.0.1; >=17.0.0, <17.0.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

• CVE-2026-93852 at cve.org, NVD
• CWE-862: Missing Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 18. 9. 2026.

An authenticated remote attacker with a TempURL address signed with an account-level key can, via the active tempurl component in OpenStack Swift, manipulate the X-Copy-From HTTP header to read other data within the same account without authorization [4].

The vulnerability is present in product:

• OpenStack Swift; >=2.4.0, <2.35.5; >=2.36.0, <2.36.4; >=2.37.0, <2.37.4; >=2.38.0, <2.38.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

• CVE-2026-97149 at cve.org, NVD
• CWE-184: Incomplete List of Disallowed Inputs at cwe.mitre.org

The vulnerability was publicly disclosed 24. 9. 2026.