Read the docs
TI-2018-07711 Aliases CVE-2018-10898GHSA-9xj4-8jr9-rf9f

Hard-coded credentials in [UNKNOWN] openstack-tripleo-heat-templates

Priority MEDIUM 40CWE-798Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-798.

Summary

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.

Why it matters now

EPSS 0.00885 59th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]openstack-tripleo-heat-templates8.0.2-40—No fix listedCNA
  • openstack-tripleo-heat-templates Vendor[UNKNOWN] Affected 8.0.2-40 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:a:openstack:tripleo_heat_templates:*:*:*:*:*:*:*:*before 8.0.2-40VulnerableOpenStack
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:a:openstack:tripleo_heat_templates:*:*:*:*:*:*:*:* Versions before 8.0.2-40 Vulnerable ·OpenStack

Remediation

Red Hat 1 advisory

  • RHSA-2018:2214 Released 2018-07-19 · Red Hat rating Important
    openstack-tripleo-heat-templates security update
    • Red Hat OpenStack Platform 13.0 openstack-tripleo-common-8.6.1-23.el7ost, openstack-tripleo-common-container-base-8.6.1-23.el7ost, openstack-tripleo-common-containers-8.6.1-23.el7ost +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13.0Fixed RHSA-2018:2214
Not affected: 6 products
  • Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 11 (Ocata)
  • Red Hat OpenStack Platform 12 (Pike)
  • Red Hat OpenStack Platform 8 (Liberty)
  • Red Hat OpenStack Platform 9 (Mitaka)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10898
  2. 2026-10-03 Alias added: GHSA-9xj4-8jr9-rf9f

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences