Sign in
Deutsch English Español Polski
Medium

OpenStack Nova Router metadata queries are not restricted by tenant

  • Disclosed: 17.05.2022
  • Updated: 11.10.2026 13:18

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) nova < 12.0.0a0 12.0.0a0

References

CVSS score -
Weakness (CWE)
CWE-200
Platform
Python (PyPI)
Package
nova
Disclosed
17.05.2022
Updated
11.10.2026 13:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-858 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-22w9-j288-8p9w - CC BY 4.0

Vulnerability history: nova

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (49) in the archive
Total entries
49
First → latest
08.2012 06.2026
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 11
  • Medium 29
  • Low 8

Disclosures per year

earlier: 7

Severity:
  1. OpenStack Nova calls qemu-img without format restrictions for resize
    High · 8.2 CVE-2026-24708 >= 32.0.0.0rc1, <= 32.1.0, >= 31.0.0.0rc1, <= 31.2.0, <= 30.2.1 no fix
  2. OpenStack Nova Router metadata queries are not restricted by tenant this entry
    Medium CVE-2013-6419 < 12.0.0a0 12.0.0a0
  3. OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
    High · 7.5 CVE-2015-5162 < 12.0.4 12.0.4
  4. OpenStack Nova logs sensitive context from notification exceptions
    Critical · 9.8 CVE-2017-7214 >= 13.0.0, < 13.1.4, >= 14.0.0, < 14.0.5, >= 15.0.1, < 15.0.2 13.1.4, 14.0.5, 15.0.2
  5. OpenStack Nova Denial of service attack on the compute host
    High · 7.5 CVE-2017-18191 >= 15.0.0, < 15.1.1, >= 16.0.0, < 16.1.2 15.1.1, 16.1.2
  6. OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
    High · 8.6 CVE-2017-17051 < 16.0.4 16.0.4
  7. An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously underg
    High · 8.3 CVE-2020-17376 < 19.3.1, >= 20.0.0, < 20.3.1, >= 21.0.0, < 21.1.0 19.3.1, 20.3.1, 21.1.0
  8. An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exceptio
    High · 6.5 CVE-2019-14433 >= 19.0.0, < 19.0.2, < 17.0.12, >= 18.0.0, < 18.2.2 19.0.2, 17.0.12, 18.2.2
  9. OpenStack Nova VMWare driver leaks rescued images
    High · 6.5 CVE-2014-2573 < 12.0.0a0 12.0.0a0
  10. OpenStack Nova Live migration can leak root disk into ephemeral storage
    High · 7.5 CVE-2013-7130 < 12.0.0a0 12.0.0a0
  11. OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM
    High · 6.5 CVE-2013-0335 < 12.0.0a0 12.0.0a0
  12. OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function
    High · 6.5 CVE-2013-1838 < 12.0.0a0 12.0.0a0
  13. virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an ima
    High · 6.5 CVE-2012-3447 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.