---
id: CVE-2017-12155
aliases:
  - GHSA-w8gx-hhcx-px6w
  - PYSEC-2026-754
title: Openstack tripleo-heat-templates unauthenticated file access
summary: Openstack tripleo-heat-templates unauthenticated file access
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
vendor: tripleo-heat-templates
product: tripleo-heat-templates
ecosystem: pip
affected:
  - tripleo-heat-templates < 7.0.6
patched:
  - tripleo-heat-templates 7.0.6
published: '2022-05-13'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:41.781066661Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-w8gx-hhcx-px6w'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-12155'
  - url: 'https://access.redhat.com/errata/RHSA-2018:0602'
  - url: 'https://access.redhat.com/errata/RHSA-2018:1593'
  - url: 'https://access.redhat.com/errata/RHSA-2018:1627'
  - url: 'https://bugs.launchpad.net/tripleo/+bug/1720787'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1489360'
  - url: 'https://github.com/openstack/tripleo-heat-templates'
  - url: >-
      https://opendev.org/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4
  - url: >-
      https://opendev.org/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30
tags:
  - osv
  - pip
epss: 0.00322
epssPercentile: 0.25336
ingestedAt: '2026-07-08T18:25:53.584Z'
---

## Overview

A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions [7.0.6](https://github.com/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4) and [8.0.0](https://github.com/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30).

## Affected packages

- `tripleo-heat-templates < 7.0.6`

## Remediation

Upgrade to a patched release:

- `tripleo-heat-templates 7.0.6`