{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat OpenStack Platform 18.0: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--red-hat-openstack-platform-18-0/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--red-hat-openstack-platform-18-0/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114236/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114236/",
   "title": "CVE-2026-114236 disclosed",
   "content_text": "storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit",
   "date_published": "2026-10-21T08:04:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92982/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92982/",
   "title": "CVE-2026-92982 disclosed",
   "content_text": "A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.",
   "date_published": "2026-10-15T15:36:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83535/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83535/",
   "title": "CVE-2026-83535 disclosed",
   "content_text": "A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.",
   "date_published": "2026-10-12T18:50:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83536/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83536/",
   "title": "CVE-2026-83536 disclosed",
   "content_text": "A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.",
   "date_published": "2026-10-12T18:50:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-107935/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-107935/",
   "title": "CVE-2026-107935 disclosed",
   "content_text": "A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.",
   "date_published": "2026-10-09T09:05:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89091/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89091/",
   "title": "CVE-2026-89091 disclosed",
   "content_text": "A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.",
   "date_published": "2026-10-08T21:49:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89091/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89091/",
   "title": "CVE-2026-89091 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: ansible-core 2.21.5-2.1, ansible-core-2.18 2.18.19-3.1, ansible-core-2.19 2.19.14-2.1, ansible-core-2.20 2.20.10-2.1.",
   "date_published": "2026-10-08T21:49:30Z"
  }
 ]
}