CVE-2015-7945: The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11....

Security readout for executives and security teams

Ganeti’s REST control interface could expose the DRBD secret through instance information job results. For organizations running affected Ganeti clusters, this is a management-plane secret leak, not just an application bug. Business urgency depends on whether ganeti-rapi is enabled, reachable, and running one of the vulnerable release lines. Exposure is most likely in environments using Ganeti with the RESTful control interface, also called RAPI or ganeti-rapi, on affected versions. Internet or broadly reachable management interfaces raise concern. Environments not using Ganeti, not exposing RAPI, or already updated beyond the fixed versions are less likely exposed. Prioritize remediation for Ganeti clusters where RAPI is enabled or reachable outside a tightly controlled admin network. The main business risk is leakage of a cluster storage replication secret from virtualization infrastructure. If Ganeti is not deployed, this CVE should be closed as not applicable. Mitigation focus: Upgrade Ganeti to the fixed release for the deployed branch or later.; Restrict ganeti-rapi access to trusted administrative networks only.; Review vendor and distribution advisories for branch-specific remediation guidance..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.