Read the docs
TI-2022-07512 Aliases CVE-2022-23452GHSA-6p2h-rjj7-2j63

Incorrect authorization in openstack/barbican

Priority LOW 25CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.

Why it matters now

EPSS 0.01294 70th percentileScored 2026-11-07
Fix Partial barbican (PyPI): 14.0.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openstack/barbicanFixed in v14.0.0—No fix listedCNA
—barbican (PyPI)before 14.0.014.0.0Patch availableGHSA-6p2h-rjj7-2j63
  • openstack/barbican Vendor— Affected Fixed in v14.0.0 Fixed in — No fix listed CNA
  • barbican (PyPI) Vendor— Affected before 14.0.0 Fixed in 14.0.0 Patch available GHSA-6p2h-rjj7-2j63

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:barbican:*:*:*:*:*:*:*:*before 14.0.0VulnerableOpenStack
cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*16.1VulnerableRed Hat
  • cpe:2.3:a:openstack:barbican:*:*:*:*:*:*:*:* Versions before 14.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-6p2h-rjj7-2j63 barbican (PyPI) Fixed in 14.0.0 Advisory →

Red Hat 2 advisories

  • RHSA-2022:8874 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1.9 (openstack-barbican) security update
    • Red Hat OpenStack Platform 16.1 openstack-barbican-9.0.1-1.20220916133702.07be198.el8ost, openstack-barbican-api-9.0.1-1.20220916133702.07be198.el8ost, openstack-barbican-common-9.0.1-1.20220916133702.07be198.el8ost +3
  • RHSA-2022:5114 Released 2022-06-22 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (openstack-barbican) security update
    • Red Hat OpenStack Platform 16.2 openstack-barbican-9.0.2-2.20220122185348.c718783.el8ost, openstack-barbican-api-9.0.2-2.20220122185348.c718783.el8ost, openstack-barbican-common-9.0.2-2.20220122185348.c718783.el8ost +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:8874
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:5114

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23452
  2. 2026-10-03 Alias added: GHSA-6p2h-rjj7-2j63

References

Patch 1

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences