Skip to content
OpenAdvisories
High RHSA-2026:94039 5 CVEs

Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 security advisory

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 19

ReleasePackageFixed in
Red Hat · OpenStack 13 openstack:13::el7 openstack-keystone 1:13.0.4-10.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-api 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-cells 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-common 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-compute 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-conductor 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-console 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-migration 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-network 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-novncproxy 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-placement-api 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-scheduler 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-serialproxy 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 openstack-nova-spicehtml5proxy 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 python-keystone 1:13.0.4-10.el7ost
Red Hat · OpenStack 13 openstack:13::el7 python-nova 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 python-nova-tests 1:17.0.13-43.el7ost
Red Hat · OpenStack 13 openstack:13::el7 python-webob 0:1.7.2-2.el7ost

Vulnerabilities 5

  • High 8.2
    CVE-2026-24708

    OpenStack Nova calls qemu-img without format restrictions for resize

    An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img withou…

    OpenStack Nova nova nova Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2026-54770

    WebOb: Open redirect in Location header normalization via leading C0 control / space characters

    WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control chara…

    Pylons webob webob python-webob Debian Ubuntu Azure Linux PyPI
  • Medium 6.0
    CVE-2026-43000

    OpenStack Keystone has an Incorrect Authorization issue

    An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Ke…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI
  • Medium 5.4
    CVE-2026-46448

    OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

    In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

    OpenStack Nova nova nova Debian Ubuntu PyPI
  • Low 3.5
    CVE-2026-33551

    OpenStack Keystone: Restricted application credentials can create EC2 credentials

    An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an auth…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2430312
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451037
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482826
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520616
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94039.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-24708
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24708
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24708
  • article
    https://bugs.launchpad.net/nova/+bug/2137507
  • report
    https://access.redhat.com/security/cve/CVE-2026-33551
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33551
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33551
  • article
    http://www.openwall.com/lists/oss-security/2026/04/07/12
  • article
    https://security.openstack.org/ossa/OSSA-2026-005.html
  • article
    https://www.openwall.com/lists/oss-security/2026/04/07/12
  • report
    https://access.redhat.com/security/cve/CVE-2026-43000
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43000
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43000
  • article
    https://bugs.launchpad.net/keystone/+bug/2148477
  • article
    https://security.openstack.org/ossa/OSSA-2026-015.html
  • report
    https://access.redhat.com/security/cve/CVE-2026-46448
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-46448
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-46448
  • article
    http://www.openwall.com/lists/oss-security/2026/06/16/5
  • article
    https://bugs.launchpad.net/nova/+bug/2151252
  • article
    https://www.openwall.com/lists/oss-security/2026/06/16/5
  • report
    https://access.redhat.com/security/cve/CVE-2026-54770
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-54770
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-54770
  • article
    https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07
  • article
    https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g
  • article
    https://github.com/Pylons/webob/tree/1.8.11