← Vulnerability feed

Vulnerability record · CVE-2016-9185 · published 4 November 2016

CVE-2016-9185: Openstack heat information exposure vulnerability

Openstack · Heat

In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.

4.3 CVSS 3.0 Medium EPSS 1.5% · top 26.1% CWE-200 · Information exposure
4.3CVSS 3.0 base score, v2 4.0
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/94205 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1450
https://access.redhat.com/errata/RHSA-2017:1456
https://access.redhat.com/errata/RHSA-2017:1464
https://bugs.launchpad.net/ossa/+bug/1606500 Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/94205 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1450
https://access.redhat.com/errata/RHSA-2017:1456
https://access.redhat.com/errata/RHSA-2017:1464
https://bugs.launchpad.net/ossa/+bug/1606500 Issue TrackingThird Party Advisory

Track CVE-2016-9185 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.5CVE-2017-2621Openstack heat sensitive information in log file vulnerabilityAn access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improp…EPSS 0.41%5.0CVE-2024-7319Openstack heat information exposure vulnerabilityAn incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon …EPSS 0.39%5.0CVE-2023-1625Openstack heat vulnerabilityAn information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reve…EPSS 0.72%4.0CVE-2013-6426Openstack heat permissions and access controls vulnerabilityThe cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enfor…EPSS 1.0%4.0CVE-2013-6428Openstack heat permissions and access controls vulnerabilityThe ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass …EPSS 1.7%3.5CVE-2014-3801Openstack heat information exposure vulnerabilityOpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remot…EPSS 1.6%5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed7.5CVE-2026-20133Cisco Catalyst SD-WAN Manager insufficient file system restrictions expose dataCisco Catalyst SD-WAN Software has insufficient file system restrictions that let an attacker read sensitive files on the underlying operating system…KEVEPSS 32%analysed

Source: NIST National Vulnerability Database (record CVE-2016-9185), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.