CVE-2021-3654: Openstack Nova

Medium severity, CVSS 6.1. EPSS: 26.8% chance of exploitation in the next 30 days.

A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

Affected products

• Openstack Nova: before 21.2.3 (fixed in 21.2.3); from 22.0.0, before 22.2.3 (fixed in 22.2.3); from 23.0.0, before 23.0.3 (fixed in 23.0.3)
• Red Hat Openstack Platform: version 16.1 only; version 16.2 only

Published 2022-03-02. Last modified 2026-06-17.