A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1.

published 2021-05-06 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-18793

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits: 0; none known

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality.

Patch / fix

distros 1

tripleo-ansible openstack 16.1 0.5.1-1.20210323173506.el8ost

red hat advisories RHSA-2021:2119

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-31918 updated 2025-11-21 cvss 7.5

tripleo-ansible: ansible.log file is visible to unprivileged users

Red Hat OpenStack Platform 16.1 tripleo-ansible 0.5.1-1.20210323173506.el8ost
fixed: vendor fix “This vulnerability can be resolved by manually adjusting the file permissions. Run the following command: chmod o-r /var/lib/mistral/overcloud/ansible.log” RHSA-2021:2119

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.00% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

n/a tripleo-ansible

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-732 Incorrect Permission Assignment for Critical Resource

References

bugzilla.redhat.com /show_bug.cgi?id=1954250
issue-tracking, vendor-advisory

Sources

CVE List CVE-2021-31918
NVD CVE-2021-31918

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary