CVE-2016-7404

Openstack Magnum Unsafe Credential Handling

9.8 CriticalFix available

CVE-2016-7404 is a critical vulnerability (CVSS 9.8) in Openstack Magnum, published May 10, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in openstack-magnum 5.0.0.

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.88%Up 0.9 points since Jul 1, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-7404
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-7404
Updated: 2026-11-02

EUVDEUVD-2022-2957 No score

Record: EUVD-2022-2957
Updated: 2026-11-03

GitHub AdvisoriesGHSA-793v-r35j-9rp9 9.8

Openstack Magnum Unsafe Credential Handling

Record: GHSA-793v-r35j-9rp9
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-200
Updated: 2026-11-02

OSV 9.8

Record: CVE-2016-7404
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-7404 9.8

Record: DEBIAN-CVE-2016-7404
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-793v-r35j-9rp9 9.8

Openstack Magnum Unsafe Credential Handling

Record: GHSA-793v-r35j-9rp9
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-200
Updated: 2026-11-02

OSVPYSEC-2026-437 9.8

Openstack Magnum Unsafe Credential Handling

Record: PYSEC-2026-437
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-7404 9.8

Record: UBUNTU-CVE-2016-7404
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVSUSE-SU-2017:1233-1 No score

Security update for openstack-magnum

This update for openstack-magnum fixes the following issues:

Security issues fixed:

CVE-2016-7404: Magnum created instances have full API access to creating user's OpenStack account (bsc#998182).

Bugfixes:

Fixed exception for InvalidParameterValue.
Updated patches have been tested against magnum-3.1.2.dev20

Record: SUSE-SU-2017:1233-1
Updated: 2026-11-02

Affected products

openstack magnum

Affected packages

Affected packages
Package	Affected	Fixed
`openstack-magnum` PyPI	before 5.0.0	5.0.0
`magnum` Debian:12	before 3.1.1-5	3.1.1-5
`magnum` Debian:13	before 3.1.1-5	3.1.1-5
`magnum` Debian:14	before 3.1.1-5	3.1.1-5
`openstack-magnum` PyPI	before 5.0.0, plus listed versions 2.0.0	5.0.0
`openstack-magnum` SUSE:OpenStack Cloud 7	before 3.1.2~a0~dev20-9.4	3.1.2~a0~dev20-9.4
`openstack-magnum-doc` SUSE:OpenStack Cloud 7	before 3.1.2~a0~dev20-9.3	3.1.2~a0~dev20-9.3
`magnum` Ubuntu:16.04:LTS	All versions, plus listed versions 1.0.0~b1-52.0.0-4ubuntu1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less