{"id":"CVE-2023-6110","aliases":["GHSA-2ppf-2m6f-6v6f","PYSEC-2026-1853"],"title":" OpenStack improperly deletes access rules","summary":" OpenStack improperly deletes access rules","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","vendor":"python-openstackclient","product":"python-openstackclient","ecosystem":"pip","affected":["python-openstackclient < 6.3.0"],"patched":["python-openstackclient 6.3.0"],"published":"2024-11-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2ppf-2m6f-6v6f","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6110"},{"url":"https://github.com/openstack/python-openstackclient/commit/bc60e3bb908a7f10c87993d791184bfe46784d6c"},{"url":"https://access.redhat.com/errata/RHSA-2024:2737"},{"url":"https://access.redhat.com/errata/RHSA-2024:2769"},{"url":"https://access.redhat.com/security/cve/CVE-2023-6110"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212960"},{"url":"https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf"},{"url":"https://github.com/openstack/python-openstackclient"},{"url":"https://review.opendev.org/c/openstack/python-openstackclient/+/888697"}],"tags":["osv","pip"],"epss":0.00493,"epssPercentile":0.41452,"ingestedAt":"2026-07-08T18:25:44.589Z","slug":"CVE-2023-6110","body":"## Overview\n\nA flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.\n\n## Affected packages\n\n- `python-openstackclient < 6.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `python-openstackclient 6.3.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}