CVE-2017-15139: Openstack Cinder

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Affected products

• Openstack Cinder: up to and including 12.0.4-7
• Red Hat Openstack: version 10 only; version 13 only

Published 2018-08-27. Last modified 2026-06-17.