Description
A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Red Hat OpenStack Platform | 13.0-17.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | barbican | 1:15.0.0~rc3-1 | — |
| Debian 13 | barbican | 1:15.0.0~rc3-1 | — |
| Debian 12 | barbican | 1:15.0.0~rc3-1 | — |
| Debian 11 | barbican | 1:11.0.0-3+deb11u1 | DSA-5247-1 |
| Debian 10 | barbican | 1:7.0.0-1+deb10u1 | DLA-3136-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | barbican | 2:14.0.0-0ubuntu1.1 | USN-5697-1 |
| Ubuntu 20.04 LTS | barbican | 1:10.1.0-0ubuntu2.2 | USN-5697-1 |
| Ubuntu 18.04 LTS | barbican | 1:6.0.1-0ubuntu1.2 | USN-5697-1 |
| Ubuntu 16.04 LTS | barbican | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | python3-barbican +3 | 12.0.1-0.20220614210405.486e607.el9ost | RHSA-2022:6750 |
| Red Hat OpenStack 16 | python3-barbican +3 | 9.0.1-1.20220112203416.07be198.el8ost | RHSA-2022:6750 |
| Red Hat OpenStack 13 | openstack-barbican +2 | 6.0.1-6.el7ost | RHSA-2022:6750 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.17.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev5-3.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev6-3.15.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev209-3.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev52-3.37.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | spark | 2.2.3-5.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-barbican +1 | 5.0.2~dev3-3.17.2 | SUSE-SU-2023:0071-1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.17.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev5-3.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev6-3.15.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev209-3.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev52-3.37.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | spark | 2.2.3-5.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.37.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev209-6.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev92-3.43.1 | SUSE-SU-2023:0070-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 8 | openstack-barbican +1 | 5.0.2~dev3-3.17.2 | SUSE-SU-2023:0071-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.43.2 | SUSE-SU-2023:0071-1 |
| SUSE HPE Helion OpenStack 8 | openstack-barbican +1 | 5.0.2~dev3-3.17.2 | SUSE-SU-2023:0071-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.43.2 | SUSE-SU-2023:0071-1 |
Advisories 7
- RHSA-2022:6750 Red Hat Security Advisory: Red Hat OpenStack Platform (openstack-barbican) security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- USN-5697-1 barbican vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5247-1 barbican - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3136-1 barbican - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:0070-1 Security update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0071-1 Security update for openstack-barbican SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1586 Red Hat OpenStack: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 11, 2023