PT-2024-3877

CVE-2024-29156

Published

2024-01-04

Updated

2026-07-07

Description by

CVSS 2.0

7.2

High

MetricsAV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenStack Murano versions prior to 16.0.0 with YAQL versions prior to 3.0.0

Description: The issue is related to the Murano service's MuranoPL extension to the YAQL language, which fails to sanitize the supplied environment. This could lead to potential leakage of sensitive service account information.

Recommendations: For OpenStack Murano versions prior to 16.0.0 with YAQL versions prior to 3.0.0, consider disabling the Murano service or fully removing it from all OpenStack deployments as a temporary workaround until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Edwardzpeng

Kirualawliet

Zhiniang Peng

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control