---
id: CVE-2024-29156
aliases:
  - GHSA-mvf6-hwxh-7v76
  - PYSEC-2026-2059
title: Information leakage in YAQL
summary: Information leakage in YAQL
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: yaql
product: yaql
ecosystem: pip
affected:
  - yaql < 3.0.0
patched:
  - yaql 3.0.0
published: '2024-03-18'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mvf6-hwxh-7v76'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-29156'
  - url: 'https://bugs.launchpad.net/murano/+bug/2048114'
  - url: 'https://launchpad.net/bugs/2048114'
  - url: 'https://opendev.org/openstack/murano/tags'
  - url: >-
      https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3
  - url: 'https://wiki.openstack.org/wiki/OSSN/OSSN-0093'
tags:
  - osv
  - pip
epss: 0.00746
epssPercentile: 0.52868
ingestedAt: '2026-07-08T18:25:51.451Z'
---

## Overview

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

## Affected packages

- `yaql < 3.0.0`

## Remediation

Upgrade to a patched release:

- `yaql 3.0.0`