CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2024-29156
Medium (6.5) in openstack. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in yaql 3.0.0.
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-116
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:murano
- openstack:yaql
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mvf6-hwxh-7v76 | PyPI | yaql | <3.0.0 | 3.0.0 |
| PYSEC-2026-2059 | PyPI | yaql | <3.0.0 | 3.0.0 |