Announce

Download

announce@lists.alasca.cloud

June 2026

1 participants
2 discussions

[Security Advisory][nova] CVE-2026-46448
by Stefan Hoffmann June 17, 2026

June 17, 2026

Hi yaook users, yesterday OpenStack published a security advisory for nova. Nova’s server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. The following images are vulnerable: nova images before 1.1.141 yaook release before 2.3.2 Hints on upgrading are written at our security advisory[1] Best regards Stefan [1] https://yaook.cloud/security-advisories-cve-2026-46448/ -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

1 0

[Security Advisory][keystone][neutron] OSSA-2026-007, CVE-2026-49299, CVE-2026-50266
by Stefan Hoffmann June 10, 2026

June 10, 2026

Hi, in the last weeks some further CVEs got published by OpenStack. The patches are mostly already in the upstream branches, we build backports for not supported versions. But our images needed to be rebuild to fetch the new changes. These keystone CVE is a vulnerability in the Keystone LDAP identity backend. When the user_enabled_invert configuration option was False (the default), Keystone did not correctly interpret the LDAP enabled attribute, causing users disabled in LDAP to be treated as enabled and allowed to authenticate. Deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected. The CVEs in OpenStack Neutron allow bypassing policies for ports or tagging. The following images are vulnerable: * keystone images before 3.0.88 * neutron images before 1.0.191 * yaook release before 2.3.1 If this images are used in your cluster for keystone-api/neutron-api deployment, the cluster is vulnerable. Also check the security advisories for keystone[1] and neutron[2] how to update your deployments. Regards Stefan [1] https://yaook.cloud/security-advisories-ossa-2026-007/ [2] https://yaook.cloud/security-advisories-cve-2026-49299-50266/ -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

1 0