Red Hat Openstack Platform 17.1 vulnerabilities

22 CVEs affecting Red Hat Openstack Platform 17.1, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92982, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2024-4437, published 2024-05-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using…
CVE-2024-4436, published 2024-05-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Red Hat OpenStack platform is using…
CVE-2026-87874, published 2026-09-09. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit…
CVE-2026-22797, published 2026-01-19. Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware…
CVE-2026-34956, published 2026-05-05. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-92091, published 2026-09-16. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2026-89091, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation…

Latest

CVE-2026-92982, published 2026-10-15. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values.…
CVE-2026-75092, published 2026-09-15. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config…
CVE-2026-84828, published 2026-09-10. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary…
CVE-2026-87872, published 2026-09-09. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and…
CVE-2026-80158, published 2026-08-26. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos…
CVE-2026-11837, published 2026-06-10. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without…
CVE-2026-44393, published 2026-06-04. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When…