CVE-2022-23451: Openstack Barbican

High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Affected products

• Openstack Barbican: before 14.0.0 (fixed in 14.0.0)
• Red Hat Openstack Platform: version 13.0 only; version 16.1 only; version 16.2 only

Published 2022-09-06. Last modified 2026-06-17.