The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline…
Priority LOW 36CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.
Why it matters now
EPSS 0.01697 77th percentileScored 2026-11-07
Fix Fixed tripleo-heat-templates (PyPI): 0.8.10Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | tripleo-heat-templates (PyPI) | before 0.8.10 | 0.8.10 | Patch available | GHSA-m94p-8942-pm49 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- tripleo-heat-templates (PyPI) Vendor— Affected before 0.8.10 Fixed in 0.8.10 Patch available GHSA-m94p-8942-pm49
Remediation
- Fix · GHSA-m94p-8942-pm49 tripleo-heat-templates (PyPI) Fixed in 0.8.10 Advisory →
Red Hat 1 advisory
- RHSA-2015:2650 Released 2015-12-21 · Red Hat rating ModerateRed Hat Enterprise Linux OpenStack Platform 7 director update
- OpenStack 7.0 Director for RHEL 7 openstack-tripleo-heat-templates-0.8.6-94.el7ost, python-rdomanager-oscplugin-0.0.10-22.el7ost
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenStack 7.0 Director for RHEL 7 | Fixed | RHSA-2015:2650 |
Not affected: 1 product
- Red Hat OpenStack Platform 8 (Liberty) Director
Timeline
- 2026-10-02 Threatist record created from CVE-2015-5303
- 2026-10-03 Alias added: GHSA-m94p-8942-pm49
References
Other 7
- https://bugs.launchpad.net/tripleo/+bug/1516027
- https://github.com/openstack/tripleo-heat-templates/commit/1a0c7d97165c1b38dc9f78b82ac6ec8519fcf80c
- https://github.com/openstack/tripleo-heat-templates/commit/293f19b2a41386e1eea47a9e6add24b006c69c42
- https://github.com/openstack/tripleo-heat-templates
- https://github.com/pypa/advisory-database/tree/main/vulns/tripleo-heat-templates/PYSEC-2016-35.yaml
- https://opendev.org/openstack/tripleo-heat-templates/commit/1a0c7d97165c1b38dc9f78b82ac6ec8519fcf80c
- https://opendev.org/openstack/tripleo-heat-templates/commit/293f19b2a41386e1eea47a9e6add24b006c69c42
More OpenStack Tripleo Heat Templates vulnerabilities
- TI-2018-07711 Hard-coded credentials in [UNKNOWN] openstack-tripleo-heat-templates CVSS 3.0HIGH 8.8
- TI-2015-04429 The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity… CVSS 3.0HIGH 7.5
- TI-2021-02534 Information disclosure in openstack/tripleo-heat-templates. CVSS 3.1MEDIUM 5.5
- TI-2021-03047 Information disclosure in openstack-tripleo-heat-templates CVSS 3.1MEDIUM 4.3
Sources
- CVE-2015-5303 · CVE Program
- CVE-2015-5303 · NVD
- FIRST EPSS
- GHSA-m94p-8942-pm49 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-5303 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences