Sign in
Deutsch English Español Polski
Medium

OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor

  • Disclosed: 22.04.2022
  • Updated: 11.10.2026 13:17

OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) nova < 12.0.0a0 12.0.0a0

References

CVSS score 5.9/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-200
Platform
Python (PyPI)
Package
nova
Disclosed
22.04.2022
Updated
11.10.2026 13:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-691 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-vcmv-6rxx-fh7r - CC BY 4.0

Vulnerability history: nova

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (49) in the archive
Total entries
49
First → latest
08.2012 06.2026
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 11
  • Medium 29
  • Low 8

Disclosures per year

earlier: 7

Severity:
  1. OpenStack Nova calls qemu-img without format restrictions for resize
    High · 8.2 CVE-2026-24708 >= 32.0.0.0rc1, <= 32.1.0, >= 31.0.0.0rc1, <= 31.2.0, <= 30.2.1 no fix
  2. OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
    High · 7.5 CVE-2015-5162 < 12.0.4 12.0.4
  3. OpenStack Nova logs sensitive context from notification exceptions
    Critical · 9.8 CVE-2017-7214 >= 13.0.0, < 13.1.4, >= 14.0.0, < 14.0.5, >= 15.0.1, < 15.0.2 13.1.4, 14.0.5, 15.0.2
  4. OpenStack Nova Denial of service attack on the compute host
    High · 7.5 CVE-2017-18191 >= 15.0.0, < 15.1.1, >= 16.0.0, < 16.1.2 15.1.1, 16.1.2
  5. OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
    High · 8.6 CVE-2017-17051 < 16.0.4 16.0.4
  6. OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor this entry
    Medium · 5.9 CVE-2011-4076 < 12.0.0a0 12.0.0a0
  7. An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously underg
    High · 8.3 CVE-2020-17376 < 19.3.1, >= 20.0.0, < 20.3.1, >= 21.0.0, < 21.1.0 19.3.1, 20.3.1, 21.1.0
  8. An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exceptio
    High · 6.5 CVE-2019-14433 >= 19.0.0, < 19.0.2, < 17.0.12, >= 18.0.0, < 18.2.2 19.0.2, 17.0.12, 18.2.2
  9. OpenStack Nova VMWare driver leaks rescued images
    High · 6.5 CVE-2014-2573 < 12.0.0a0 12.0.0a0
  10. OpenStack Nova Live migration can leak root disk into ephemeral storage
    High · 7.5 CVE-2013-7130 < 12.0.0a0 12.0.0a0
  11. OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM
    High · 6.5 CVE-2013-0335 < 12.0.0a0 12.0.0a0
  12. OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function
    High · 6.5 CVE-2013-1838 < 12.0.0a0 12.0.0a0
  13. virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an ima
    High · 6.5 CVE-2012-3447 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.