CVE-2019-10138: Python Novajoin

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Affected products

• Python Novajoin: before 1.1.1 (fixed in 1.1.1)

Published 2019-07-30. Last modified 2026-06-17.