May 2026 - Announce - lists.alasca.cloud

[Security Advisory][keystone] CVE-2026-42998, CVE-2026-42999, CVE-2026-42300, CVE-2026-42301, CVE-2026-44394
by Stefan Hoffmann May 28, 2026

May 28, 2026

Hi, OpenStack published a bunsh of CVEs at keystone. These five CVEs in OpenStack Keystone are all post-auth privilege escalation or scope expansion vulnerabilities. All Keystone releases supported by YAOOK are affected. For details of the particular exploitation flows, please consult the upstream advisory. The YAOOK authors consider CVE-2026-42999 to be the most severe one. It allows cross-project privilege escalation by anyone who can obtain a valid OpenStack token, effectively breaking tenant isolation and potentially allowing escalation to cloud admin privileges. The following images are vulnerable: * keystone images before 3.0.87 * yaook release before 2.3.0 If this image is used in your cluster for the keystone-api deployment, the cluster is vulnerable. The fixed image has been built in a private pipeline[1] which has been published alongside this advisory to prove the image provenance. We recommend to *immediately* add a YAOOK_OP_VERSIONS_OVERRIDE[2] variable to your Keystone operator container to pull the image before the YAOOK comprehensive release is ready. |operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { "registry.yaook.cloud/yaook/keystone-2023.2": "registry.yaook.cloud/yaook/keystone-2023.2:3.0.87", "registry.yaook.cloud/yaook/keystone-2024.1": "registry.yaook.cloud/yaook/keystone-2024.1:3.0.87", "registry.yaook.cloud/yaook/keystone-2024.2": "registry.yaook.cloud/yaook/keystone-2024.2:3.0.87", "registry.yaook.cloud/yaook/keystone-2025.1": "registry.yaook.cloud/yaook/keystone-2025.1:3.0.87", "registry.yaook.cloud/yaook/keystone-2025.2": "registry.yaook.cloud/yaook/keystone-2025.2:3.0.87" }| More info can be found in our security advisory[3]. Regards Stefan [1] https://gitlab.com/yaook-security/images/keystone/-/pipelines/2556551510 [2] https://docs.yaook.cloud/user/references/env-reference.html#envvar-YAOOK_OP… [3] https://yaook.cloud/security-advisories-cve-2026-42998-43001-44394/ -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

1 0

[Security Advisory][CVE-2026-42301] Unrestricted application credential can cross project boundaries
by Stefan Hoffmann May 27, 2026

May 27, 2026

Hi yaook users, OpenStack published a Bug for keystone[1]. CVE-2026-42301 allows an attacker who gets hold of an unrestricted application credential to cross project boundaries to another project, if that project is accessible to the user who created the application credential. Thus, the project scoping of application credentials is broken. Also check our Security Advisory[2]. The following images are vulnerable: – keystone images before 3.0.86 – yaook release before 2.2.1 (<= 2.2.0) If this image is used in your cluster for the keystone-api deployment, the cluster is vulnerable. A new stable release will be published according to the release cycle. You can upgrade to that release simply by updating your operators. If you want to upgrade in advance you can pin your keystone image to 3.0.86 in the keystone-operator (adjust the OpenStack version to the version you have deployed): |values: operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | || { "registry.yaook.cloud/yaook/keystone-2023.2": "registry.yaook.cloud/yaook/keystone-2023.2:3.0.86", "registry.yaook.cloud/yaook/keystone-2024.1": "registry.yaook.cloud/yaook/keystone-2024.1:3.0.86", "registry.yaook.cloud/yaook/keystone-2024.2": "registry.yaook.cloud/yaook/keystone-2024.2:3.0.86", "registry.yaook.cloud/yaook/keystone-2025.1": "registry.yaook.cloud/yaook/keystone-2025.1:3.0.86", "registry.yaook.cloud/yaook/keystone-2025.2": "registry.yaook.cloud/yaook/keystone-2025.2:3.0.86" }| Best regards Stefan [1] https://bugs.launchpad.net/keystone/+bug/2149775 [2] https://yaook.cloud/security-advisories-cve-2026-42301/ -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

1 0

YAOOK Security Advisory for OVN CVE-2026-5265 and CVE-2026-5367
by Stefan Hoffmann May 26, 2026

May 26, 2026

Hi yaook users, OVN has two CVEs that allows a user to read data from memory/packages they are not allowed to read. See also the advisory[1]. The following images are vulnerable: ovn images before 1.0.153 yaook release before v2.2.0 and the version v2.2.0 If any of these images are used in your cluster, the cluster is vulnerable. A new stable release will be published according to the release cycle. You can upgrade to that release simply by updating your operators. If you want to upgrade in advance you can pin your ovn image to v24.09.3-1.0.153 in the neutron-operator (adjust the OpenStack version to the version you have deployed): |values: operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | registry.yaook.cloud/yaook/ovn: registry.yaook.cloud/yaook/ovn:v24.09.3-1.0.153| Regards Stefan [1] https://yaook.cloud/security-advisories-cve-2026-5265-5367/ -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

1 0