Read the docs
TI-2017-09178 Aliases CVE-2017-12440GHSA-86cv-9gpx-6hwj

Aodh as packaged in Openstack Ocata and Newton before change-ID…

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-306.

Summary

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Why it matters now

EPSS 0.02146 82nd percentileScored 2026-11-07
Fix Partial aodh (PyPI): 6.0.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—aodh (PyPI)before 6.0.16.0.1Patch availableGHSA-86cv-9gpx-6hwj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • aodh (PyPI) Vendor— Affected before 6.0.1 Fixed in 6.0.1 Patch available GHSA-86cv-9gpx-6hwj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:openstack:07132017:*:*:*:*:*:*:*07132017VulnerableOpenStack
  • cpe:2.3:a:openstack:openstack:07132017:*:*:*:*:*:*:* Versions 07132017 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-86cv-9gpx-6hwj aodh (PyPI) Fixed in 6.0.1 Advisory →

Red Hat 2 advisories

  • RHSA-2018:0315 Released 2018-02-13 · Red Hat rating Moderate
    openstack-aodh security update
    • Red Hat OpenStack Platform 11.0 openstack-aodh-4.0.2-3.el7ost, openstack-aodh-api-4.0.2-3.el7ost, openstack-aodh-common-4.0.2-3.el7ost +7
  • RHSA-2017:3227 Released 2017-11-15 · Red Hat rating Moderate
    openstack-aodh security update
    • Red Hat OpenStack Platform 10.0 openstack-aodh-3.0.4-1.el7ost, openstack-aodh-api-3.0.4-1.el7ost, openstack-aodh-common-3.0.4-1.el7ost +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10.0Fixed RHSA-2017:3227
Red Hat OpenStack Platform 11.0Fixed RHSA-2018:0315
Not affected: 1 product
  • Red Hat OpenStack Platform 12 (Pike)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12440
  2. 2026-10-03 Alias added: GHSA-86cv-9gpx-6hwj

References

Patch 4

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences