CVE-2017-2621: Openstack Heat

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.

Affected products

• Openstack Heat: before 8.0.0 (fixed in 8.0.0)
• Red Hat Openstack: version 9 only; version 10 only

Published 2018-07-27. Last modified 2026-06-17.