https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:48:35.591587+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-00667 cnvd-2018-00667 2026-10-02T19:48:35.720344+00:00 cnvd-2018-00667 https://cve.radiocsirt.org/vuln/euvd-2026-165769 EUVD-2026-165769 2026-10-02T19:48:35.720383+00:00 EUVD-2026-165769 https://cve.radiocsirt.org/vuln/fkie_cve-2017-12155 fkie_cve-2017-12155 2026-10-02T19:48:35.720397+00:00

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

 https://cve.radiocsirt.org/vuln/ghsa-w8gx-hhcx-px6w GHSA-w8gx-hhcx-px6w — Openstack tripleo-heat-templates unauthenticated file access 2026-10-02T19:48:35.720427+00:00

Affected: PyPI: tripleo-heat-templates

A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions [7.0.6](https://github.com/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4) and [8.0.0](https://github.com/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30).

 https://cve.radiocsirt.org/vuln/gsd-2017-12155 gsd-2017-12155 2026-10-02T19:48:35.720454+00:00 gsd-2017-12155 https://cve.radiocsirt.org/vuln/pysec-2026-754 PYSEC-2026-754 — Openstack tripleo-heat-templates unauthenticated file access 2026-10-02T19:48:35.720465+00:00

Affected: PyPI: tripleo-heat-templates

A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions [7.0.6](https://github.com/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4) and [8.0.0](https://github.com/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30).

 https://cve.radiocsirt.org/vuln/rhsa-2018:0602 RHSA-2018:0602 — Red Hat Security Advisory: openstack-tripleo-common and openstack-tripleo-heat-templates update 2026-10-02T19:48:35.720527+00:00

openstack-tripleo-heat-templates: Ceph client keyring is world-readable when deployed by director

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-12155 UBUNTU-CVE-2017-12155 2026-10-02T19:48:35.720545+00:00

Affected: Ubuntu:16.04:LTS: tripleo-heat-templates, Ubuntu:18.04:LTS: tripleo-heat-templates

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.