Read the docs
TI-2022-07511 Aliases CVE-2022-23451GHSA-p2jg-q8hw-p7gc

Incorrect authorization in openstack/barbican

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Why it matters now

EPSS 0.0128 70th percentileScored 2026-11-07
Fix Partial barbican (PyPI): 14.0.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openstack/barbicanFixed in v14.0.0—No fix listedCNA
—barbican (PyPI)before 14.0.014.0.0Patch availableGHSA-p2jg-q8hw-p7gc
  • openstack/barbican Vendor— Affected Fixed in v14.0.0 Fixed in — No fix listed CNA
  • barbican (PyPI) Vendor— Affected before 14.0.0 Fixed in 14.0.0 Patch available GHSA-p2jg-q8hw-p7gc

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openstack:barbican:*:*:*:*:*:*:*:*before 14.0.0VulnerableOpenStack
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*13.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*16.1VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*16.2VulnerableRed Hat
  • cpe:2.3:a:openstack:barbican:*:*:*:*:*:*:*:* Versions before 14.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-p2jg-q8hw-p7gc barbican (PyPI) Fixed in 14.0.0 Advisory →

Red Hat 2 advisories

  • RHSA-2022:8874 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1.9 (openstack-barbican) security update
    • Red Hat OpenStack Platform 16.1 openstack-barbican-9.0.1-1.20220916133702.07be198.el8ost, openstack-barbican-api-9.0.1-1.20220916133702.07be198.el8ost, openstack-barbican-common-9.0.1-1.20220916133702.07be198.el8ost +3
  • RHSA-2022:5114 Released 2022-06-22 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (openstack-barbican) security update
    • Red Hat OpenStack Platform 16.2 openstack-barbican-9.0.2-2.20220122185348.c718783.el8ost, openstack-barbican-api-9.0.2-2.20220122185348.c718783.el8ost, openstack-barbican-common-9.0.2-2.20220122185348.c718783.el8ost +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:8874
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:5114
Not affected: 1 product
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23451
  2. 2026-10-03 Alias added: GHSA-p2jg-q8hw-p7gc

References

Patch 1

Advisory 3

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences