Incomplete container isolation
Priority LOW 27CWE-653Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00484 41st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openstack-barbican | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 17.0 | — | — | No fix listed | CNA |
| RDO | OpenStack RDO | — | — | No fix listed | CNA |
| — | barbican (PyPI) | up to 16.0.0 | — | No fix listed | GHSA-6rx9-c2rh-3qv4 |
- openstack-barbican Vendor— Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenStack Platform 16.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 17.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
- OpenStack RDO VendorRDO Affected — Fixed in — No fix listed CNA
- barbican (PyPI) Vendor— Affected up to 16.0.0 Fixed in — No fix listed GHSA-6rx9-c2rh-3qv4
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OpenStack |
| cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack_platform:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Red Hat |
- cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack
- cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack_platform:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Red Hat
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenStack Platform 13 (Queens)
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1636
- 2026-10-03 Alias added: GHSA-6rx9-c2rh-3qv4
- 2026-10-07 Affected versions changed · Red Hat
References
More Red Hat Openstack Platform vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2023-01529 Information leak in api CVSS 3.1HIGH 7.4
- TI-2022-03027 Uncontrolled resource consumption in openstack-neutron CVSS 3.1MEDIUM 6.5
- TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
- TI-2023-01565 A flaw was found in openvswitch (OVS). CVSS 3.1HIGH 8.2
Sources
- CVE-2023-1636 · CVE Program
- CVE-2023-1636 · NVD
- FIRST EPSS
- GHSA-6rx9-c2rh-3qv4 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-1636 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences