Security readout for executives and security teams
Plain-English summary
CVE-2021-31918 is a confidentiality flaw in tripleo-ansible as shipped with Red Hat OpenStack 16.1. During stack creation or update, an Ansible log file is readable by all local users. If those logs contain sensitive operational details or secrets, an unprivileged local user could view them.
Executive priority
Treat this as a targeted confidentiality risk for OpenStack infrastructure, not a broad internet-facing emergency. Prioritize review where many users have local access or where deployment logs may contain credentials.
Technical view
The CVE describes CWE-200 information exposure caused by overly permissive Ansible log file permissions during TripleO stack update and creation. The affected product is tripleo-ansible as shipped in Red Hat OpenStack 16.1. No CVSS score, patch detail, or precise file path is provided in the supplied sources.
Likely exposure
Exposure appears limited to environments running Red Hat OpenStack 16.1 with tripleo-ansible, especially during stack creation or update. Practical risk depends on local user access to the affected host and whether logs include secrets or sensitive deployment data.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not marked as KEV. The described issue requires the ability to read local log files while or after stack operations occur. Evidence is insufficient to assess remote exploitability.
Researcher notes
The public record is sparse: it names Red Hat OpenStack 16.1 tripleo-ansible, CWE-200, world-readable Ansible logs during stack create/update, and confidentiality impact. It does not provide CVSS, exploit details, affected file paths, or confirmed fixed versions in the supplied bundle.
Mitigation direction
- Check Red Hat guidance or errata for the supported fix status.
- Restrict shell access on affected OpenStack deployment hosts.
- Review and tighten permissions on TripleO and Ansible log locations.
- Rotate credentials if sensitive values were exposed in readable logs.
- Avoid placing secrets in logs during stack operations where possible.
Validation and detection
- Inventory Red Hat OpenStack 16.1 deployments using tripleo-ansible.
- Verify log file permissions during stack creation and update workflows.
- Review affected logs for secrets, tokens, passwords, or deployment metadata.
- Check host audit logs for unexpected local access to Ansible logs.
- Confirm vendor advisory status before closing remediation tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-31918 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=1954250CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.