{"id":"CVE-2021-31918","aliases":["EUVD-2021-18793","GHSA-r7f5-2xmq-3252","RHSA-2021:2119"],"status":"published","title":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log...","description":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00998,"percentile":0.63176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-732"],"published":"2021-05-06T16:23:06Z","modified":"2026-06-17T03:52:29Z","fixes":[{"ecosystem":"Red Hat:openstack:16.1::el8","package":"tripleo-ansible","fixed_in":["0:0.5.1-1.20210323173506.el8ost"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"tripleo-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.1-1.20210323173506.el8ost"}]}]}],"products":[{"vendor":"red hat","product":"tripleo-ansible"},{"vendor":"redhat","product":"openstack"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954250","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31918","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r7f5-2xmq-3252"},{"url":"https://access.redhat.com/errata/RHSA-2021:2119","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1899404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1911891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1916162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949398","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2119.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31918","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-31918","description":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-05-06T16:23:06Z","modified":"2024-08-03T23:10:30.968Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-18793","description":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-05-06T16:23:06Z","modified":"2024-08-03T23:10:30Z","updated_at":"2026-11-03T03:24:37.97373Z"}],"ghsa":[{"id":"GHSA-r7f5-2xmq-3252","title":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log...","description":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2022-05-24T19:01:27Z","modified":"2023-01-30T05:01:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-732"],"updated_at":"2026-11-02T14:46:29.327755Z"}],"nvd":[{"id":"CVE-2021-31918","description":"A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.","status":"published","published":"2021-05-06T17:15:08.18Z","modified":"2026-06-17T03:52:29.32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-732"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"RHSA-2021:2119","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.6 (tripleo-ansible) security update","status":"published","published":"2024-09-16T05:50:53Z","modified":"2025-11-22T12:20:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"}]}}