Veille CVE

Semaine du 4 mai au 10 mai 2026

2 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenStack Keystone » ✕
  1. CVE-2026-40213 7.4 Élevée

    OpenStack Cyborg

    OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

  2. CVE-2026-42997 7.7 Élevée

    OpenStack Ironic · Red Hat OpenShift Container Platform 4 · Red Hat OpenStack Platform 16.2 · Red Hat OpenStack Platform 17.1

    An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.