CVE-2013-6426: The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse...

Security readout for executives and security teams

This flaw let a user already inside an OpenStack instance bypass Heat policy controls and create or update orchestration stacks through the CloudFormation-compatible API. The business risk is unauthorized infrastructure changes in affected OpenStack clouds, not broad unauthenticated internet takeover based on the provided sources. Exposure is likely limited to OpenStack deployments running affected Heat versions with the CloudFormation-compatible API available to in-instance users. The bundle does not identify other products or managed services as affected. Prioritize remediation for OpenStack environments where tenants or workload users can access Heat’s CloudFormation-compatible API. The issue is old, but unauthorized stack changes can affect infrastructure integrity and cloud governance. Mitigation focus: Upgrade Heat to Havana 2013.2.1, Icehouse icehouse-2, or later fixed versions.; Apply relevant vendor updates, including Red Hat guidance where applicable.; Review OpenStack Heat advisory and Launchpad issue for environment-specific instructions..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.