Please take a look at the proposed impact description below. After a round of corrections I'll request a CVE assignment based on this additional information. We can amend the information later to include other affected projects (and reporters) if any are identified.
title: Authentication tokens included in notification payloads
reporters:
- name: Scott Solkhon
affiliation: G-Research
reported: 'CVE-TBD'
- name: Dan Smith
affiliation: Red Hat
reported: 'CVE-TBD'
description: >
Scott Solkhon with G-Research and Dan Smith with Red Hat reported
related vulnerabilities in Ironic and Nova. Some service
notification payloads may unnecessarily embed raw copies of
authentication tokens, revealing those credentials to systems
administrators who are allowed access to copies of notifications,
allowing them to impersonate the affected accounts. Only
deployments with notifications enabled using the AMQP or Kafka
drivers are affected.
Please take a look at the proposed impact description below. After a round of corrections I'll request a CVE assignment based on this additional information. We can amend the information later to include other affected projects (and reporters) if any are identified.
title: Authentication tokens included in notification payloads
reporters:
- name: Scott Solkhon
affiliation: G-Research
reported: 'CVE-TBD'
- name: Dan Smith
affiliation: Red Hat
reported: 'CVE-TBD'
affected-products:
- product: Ironic
version: '<20.1.2, >=20.2.0 <21.1.1, >=21.2.0 <21.4.1'
- product: Nova
version: '<25.2.1, >=26.0.0 <26.2.1, >=27.0.0 <27.1.1'
description: >
Scott Solkhon with G-Research and Dan Smith with Red Hat reported
related vulnerabilities in Ironic and Nova. Some service
notification payloads may unnecessarily embed raw copies of
authentication tokens, revealing those credentials to systems
administrators who are allowed access to copies of notifications,
allowing them to impersonate the affected accounts. Only
deployments with notifications enabled using the AMQP or Kafka
drivers are affected.