Ceph, OpenStack, and InLong security advisories

Security traffic centered on authentication and authorization flaws, led by a Ceph advisory that affects OpenStack and by fixes across OpenStack Aodh and Watcher, Apache InLong, Kata Containers, and rsyslog. Operators of those stacks have concrete upgrade and key-rotation steps to apply.

Multiple Ceph authentication flaws affecting OpenStack

OSSN-0108 on oss-security describes multiple authentication vulnerabilities in Ceph 19 and 20 that impact OpenStack. The notice lists four CVEs and requires server upgrades plus CephX keyring rotation for all OpenStack services. Sites that back OpenStack with Ceph need those steps to close the authentication gaps.

OpenStack Aodh and Watcher authorization bypasses

OpenStack issued OSSA-2026-036, tracked as CVE-2026-76878, for authorization bypasses in Aodh and Watcher. The flaws permit cross-project alarm enumeration in Aodh and webhook authorization bypass in Watcher. Operators of the telemetry and optimization components should apply the fixed packages to restore intended access controls.

Authenticated SSRF in Apache InLong

Apache InLong published CVE-2026-63044, an authenticated server-side request forgery issue via the POST /api/node/testConnection endpoint. Versions from 2.0.0 before 2.4.0 are affected. Data-streaming deployments should move to 2.4.0 to remove the SSRF path.

Kata Containers genpolicy mount validation flaw

Kata Containers disclosed CVE-2026-77176, covering insufficient validation of createcontainer mount and storage rules in genpolicy. The problem affects confidential-container configurations and is fixed in 4.1.0. Operators relying on Kata isolation should upgrade so mount and storage policy checks are enforced.

Rsyslog omfile dynaFile containment hardening

Rsyslog announced GHSA-xmp9-244p-5ggv, a hardening change for dynaFile path containment in the omfile module. The update enables default lexical checks on dynamic file paths. Log pipelines that use omfile dynaFile output gain tighter containment of generated paths.

Unauthorized package creation in Apache InLong

Apache InLong reported CVE-2026-63016, a moderate flaw that lets ordinary users create new packages. The issue is corrected in 2.4.0. Installations still on earlier releases should upgrade to restore package-creation controls.

SQL injection in Apache InLong

Apache InLong disclosed CVE-2026-63038, a SQL injection vulnerability that arises through string concatenation. Versions 2.0.0 before 2.4.0 are affected. Database-backed InLong deployments need the 2.4.0 release to eliminate the injection vector.

Missing DataNode authorization in Apache InLong

Apache InLong published CVE-2026-63042 for missing authorization on DataNode management endpoints. In versions 2.0 through 2.3 any authenticated user could manage DataNodes; the flaw is fixed in 2.4.0. Operators should upgrade so DataNode management is limited to authorized roles.