{"id":"CVE-2023-1633","aliases":["EUVD-2023-2449","GHSA-6qqp-4vm3-359v","PYSEC-2026-1213","RHSA-2023:6231"],"status":"published","title":"Insecure barbican configuration file leaking credential","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00193,"percentile":0.08979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-522"],"published":"2023-09-24T00:09:50Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican","fixed_in":["0:9.0.2-2.20230515185056.1cd585c.el8ost"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"16.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"16.0.0"}]}],"versions":["0","10.0.0","10.0.0.0rc1","10.1.0","11.0.0","11.0.0.0rc1","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","13.0.0","13.0.0.0rc1","13.0.1","13.0.2","14.0.0","14.0.0.0rc1","14.0.1","14.0.2","15.0.0","15.0.0.0rc1","15.0.0.0rc2","15.0.0.0rc3","15.0.1","16.0.0","16.0.0.0rc1","6.0.0.0b1","8.0.0","8.0.0.0rc1","8.0.1","9.0.0","9.0.0.0rc1","9.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"16.0.0"}]}],"versions":["0","10.0.0","10.0.0.0rc1","10.1.0","11.0.0","11.0.0.0rc1","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","13.0.0","13.0.0.0rc1","13.0.1","13.0.2","14.0.0","14.0.0.0rc1","14.0.1","14.0.2","15.0.0","15.0.0.0rc1","15.0.0.0rc2","15.0.0.0rc3","15.0.1","16.0.0","16.0.0.0rc1","6.0.0.0b1","8.0.0","8.0.0.0rc1","8.0.1","9.0.0","9.0.0.0rc1","9.0.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20230515185056.1cd585c.el8ost"}]}]}],"products":[{"vendor":"openstack","product":"barbican"},{"vendor":"rdo","product":"openstack rdo"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 16.1"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.0"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-1633","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181761","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1633","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6qqp-4vm3-359v","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://repos.fedorapeople.org/repos/openstack/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1633.json","tags":["advisory"]},{"url":"https://github.com/openstack/barbican","tags":["package"]},{"url":"https://pypi.org/project/barbican","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6231","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6231.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1633","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-1633","title":"Insecure barbican configuration file leaking credential","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2023-09-24T00:09:50.215Z","modified":"2024-09-24T15:00:33.599Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-2449","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2023-09-24T00:09:50Z","modified":"2024-09-24T15:00:33Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:15.73715Z"}],"ghsa":[{"id":"GHSA-6qqp-4vm3-359v","title":"OpenStack Barbican credential leak flaw","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2023-09-24T03:30:20Z","modified":"2023-11-08T05:04:40Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2023-1633","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2023-09-24T01:15:43.76Z","modified":"2026-06-17T05:28:24.84Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"CVE-2023-1633","title":"Insecure barbican configuration file leaking credential","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2023-09-24T00:09:50.215Z","modified":"2026-10-28T02:30:36.946339906Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"GHSA-6qqp-4vm3-359v","title":"OpenStack Barbican credential leak flaw","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2023-09-24T03:30:20Z","modified":"2026-07-07T17:56:39.526813428Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"PYSEC-2026-1213","title":"OpenStack Barbican credential leak flaw","description":"A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.","status":"published","published":"2026-07-07T11:45:25.037925Z","modified":"2026-07-07T17:46:30.035952529Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"RHSA-2023:6231","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-barbican) security update","status":"published","published":"2024-09-16T14:33:55Z","modified":"2026-10-08T10:04:11Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"}]}}