What’s Vulnerable › Vulnerabilities

CVE-2022-3596: Instack-undercloud: rsync leaks information to undercloud

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-20 · updated 2026-06-17
• Weakness: CWE-402

Description

An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.

Affected products

• nova_libvirt container provided by the Red Hat OpenStack Platform: 13.0

References

• https://access.redhat.com/errata/RHSA-2022:8897
• https://access.redhat.com/security/cve/CVE-2022-3596
• https://bugzilla.redhat.com/show_bug.cgi?id=2136596
• https://access.redhat.com/errata/RHSA-2022:8897
• https://access.redhat.com/security/cve/CVE-2022-3596
• https://bugzilla.redhat.com/show_bug.cgi?id=2136596

Get alerted when CVE-2022-3596 or the next vulnerability affects your stack