Description
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Heketi Project | heketi | heketi 6 as shipped with Openshift Container Platform 3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | heketi +2 | 9.0.0-7.el7rhgs | RHSA-2019:3255 |
Advisories 1
- RHSA-2019:3255 Red Hat Security Advisory: heketi security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025