This is the status in Debian for OSSA as per these upstream announcements:
https://security.openstack.org/ossalist.html
When one reads "osbpo only" this means that only the repositories at http://osbpo.debian.net have the fixes, and the updates are missing in Debian Stable official (ie: Bookworm and Epoxy).
Also, please note that at this point, we do not guarantee any update on anything lower than Victoria, even though a lot of the fixes below have been backported (including in Bullseye official).
OSSA / OSSN |
CVE number |
Debian bug |
Package |
Zed 2022.1 (Bookworm) |
Antelope 2023.1 |
Bobcat 2023.2 |
Caracal 2024.1 |
Dalmatian 2024.2 |
Epoxy 2025.1 (Trixie) |
Flamingo 2025.2 |
Gazpacho 2026.1 |
|
|
|
|
|
|
|
|
|
|
|
|
CVE-2026-71193, CVE-2026-71194 |
Designate |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-71201 |
Ironic |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed (Debian also) |
||
CVE-2026-55707 |
Neutron |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
||
CVE-2026-71190 |
Swift |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-71191, CVE-2026-71192 |
Swift |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-66139 |
zaqar |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-54422 |
ironic-python-agent |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-66138 |
ironic-python-agent |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-54423 |
Ironic |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-44918 |
Ironic |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-50221 |
Swift |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-54421 |
Ironic |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-46448 |
Nova |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
CVE-2026-50266 |
Neutron |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
||
CVE-2026-41283 |
Mistral |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
||
CVE-2026-44917 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-48681 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-46447 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-49299 |
|
Neutron |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-42999 CVE-2026-42998 CVE-2026-43000 CVE-2026-43001 CVE-2026-43001 |
|
Keystone |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-49017 |
|
Swift |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed (Debian as well) |
Fixed |
Fixed |
|
CVE-2026-44919 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-44916 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-40213 CVE-2026-40214 |
|
Cyborg |
Not in Debian |
Not in Debian |
Not in Debian |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-42997 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-43002 |
|
Horizon |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed |
|
CVE-2026-42510 |
|
Ironic |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
|
CVE-2026-40683 |
|
Keystone |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-40212 |
|
Skyline |
Not in Debian |
Not in Debian |
Not in Debian |
Not in Debian |
Not in Debian |
Not in Debian |
Not in Debian |
Not in Debian |
|
CVE-2026-33551 |
|
Keystone |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-34881 |
|
Glance |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-28370 |
|
Vitrage |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Not in Debian |
|
CVE-2026-24708 |
|
Nova |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
CVE-2026-22797 |
|
Keystonemiddleware |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Ironic Python Agent |
Cannot be backported |
Cannot be backported |
Cannot be backported |
Cannot be backported |
Cannot be backported |
Cannot be backported |
Cannot be backported |
Fixed |
||
|
Manila |
Unaffected |
Unaffected |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
||
|
Neutron |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
||
|
|
Nova |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
|
CVE-2026-54421 CVE-2026-43003 |
|
Ironic, ironic-python-agent |
Fixed (osbpo only) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (osbpo only) |
Fixed |
Fixed |
|
CVE-2026-50589 |
|
Ironic |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Unaffected |
Fixed |
Fixed |
|
|
|
Mistral |
Vulnerable |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |
|
|
|
Horizon |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed |
|
|
|
oslo.messaging |
Fixed (Debian also) |
Fixed |
Fixed |
Fixed |
Fixed |
Fixed (Debian also) |
Fixed |
Fixed |