RHSA-2026:94039HighCVSS 8.5

Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 security advisory

Published
November 2, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (5)

CVE-2026-24708 →CVE-2026-33551 →CVE-2026-43000 →CVE-2026-46448 →CVE-2026-54770 →

📋 Description

CVE-2026-24708 — openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova CVE-2026-33551 — openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation CVE-2026-43000 — keystone: OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse CVE-2026-46448 — openstack-nova: OpenStack Nova: Resource allocation issue due to unstripped hint data in server creation API CVE-2026-54770 — webob: WebOb: Open redirect vulnerability leading to phishing and token theft

🎯 Affected products31

  • Red Hat OpenStack Platform 13.0 - ELS
  • openstack-heat-1:10.0.3-21.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-heat-api-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-heat-api-cfn-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-heat-common-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-heat-engine-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-heat-monolith-1:10.0.3-21.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-keystone-1:13.0.4-10.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-keystone-1:13.0.4-10.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-1:17.0.13-43.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-api-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-cells-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-common-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-compute-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-conductor-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-console-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-migration-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-network-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-novncproxy-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-placement-api-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-scheduler-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-serialproxy-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • openstack-nova-spicehtml5proxy-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • puppet-heat-0:12.4.1-0.20200413050251.d61d033.el7ost.src as a component of Red Hat OpenStack Platform 13.0 - ELS
  • python-keystone-1:13.0.4-10.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • python-nova-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • python-nova-tests-1:17.0.13-43.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • python-webob-0:1.7.2-2.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 - ELS
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no configuration option to restrict which scheduler hint keys users can supply. However, operators can reduce the attack surface by: 1. Restricting access to the Nova API via network segmentation (firewall rules limiting which networks can reach the Nova API endpoint). 2. Using Keystone application credentials with limited scope to restrict which users can create servers. These mitigations reduce exposure but do not fully prevent exploitation. Workaround: Applications utilizing the WebOb library should implement strict validation of redirect target URLs. Configure applications to only allow redirects to trusted, fully-qualified URIs or to strictly allowlist permitted redirect destinations. Reject any redirect target that does not begin with an expected trusted host or a validated relative path, ensuring no leading whitespace or control characters are present.

🔗 References (8)