CVE-2021-31918
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log...
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
- Record
CVE-2021-31918- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-732
- Updated
- 2026-11-02
CVE List No score
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
- Record
CVE-2021-31918- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2021-18793 No score
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
- Record
EUVD-2021-18793- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r7f5-2xmq-3252
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log...
A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.
- Record
GHSA-r7f5-2xmq-3252- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-732
- Updated
- 2026-11-02
OSVRHSA-2021:2119
Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (tripleo-ansible) security update
- Record
RHSA-2021:2119- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tripleo-ansibleRed Hat:openstack:16.1::el8 |
before 0:0.5.1-1.20210323173506.el8ost | 0:0.5.1-1.20210323173506.el8ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-31918 is a high vulnerability (CVSS 7.5) in Red Hat Tripleo-ansible, published May 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in tripleo-ansible 0:0.5.1-1.20210323173506.el8ost.
References
bugzilla.redhat.com/show_bug.cgi?id=1954250
nvd.nist.gov/vuln/detail/CVE-2021-31918
github.com/advisories/GHSA-r7f5-2xmq-3252
access.redhat.com/errata/RHSA-2021:2119
Show 12 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2119.json
cve.org/CVERecord?id=CVE-2021-31918