CVE-2018-10898: Vulnerability in openstack-tripleo-heat-templates
Summary
CVE-2018-10898: A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. Affects tripleo-heat-templates versions < 8.0.3. Fixed in 8.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openstack-tripleo-heat-templates is a PyPI package that provides templates for deploying OpenStack using the TripleO project. It is a collection of Heat templates that define the infrastructure and services required for an OpenStack deployment. These templates are used by the OpenStack Director to deploy and configure OpenStack environments. However, a vulnerability has been discovered in versions before 8.0.2-40, where the default configuration of Opendaylight in RHOSP13 includes easily guessable default credentials.
Vulnerability Detail
The vulnerability (CVE-2018-10898) in openstack-tripleo-heat-templates allows an attacker to gain unauthorized access to the Opendaylight component in RHOSP13. By exploiting the easily guessable default credentials, an attacker can potentially perform malicious actions within the OpenStack environment. This can lead to unauthorized access, data breaches, and disruption of services.
How To Fix
Latest published version: 18.0.0 as of 22 Oct 2026
pip install --upgrade "tripleo-heat-templates==18.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.3
This is the first release that contains the fix.
pip install --upgrade "tripleo-heat-templates==8.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by manually changing the default credentials for Opendaylight in the RHOSP13 configuration. This can be done by modifying the configuration files and replacing the default credentials with strong, unique passwords. It is important to ensure that the new credentials are securely stored and not easily guessable.
Conclusion
In conclusion, the vulnerability in openstack-tripleo-heat-templates allows unauthorized access to Opendaylight in RHOSP13 due to easily guessable default credentials. To mitigate this vulnerability, it is recommended to upgrade to version 8.0.3 or later of tripleo-heat-templates. If immediate upgrade is not possible, manually changing the default credentials is a viable workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tripleo-heat-templates →
FAQ
openstack-tripleo-heat-templates is a PyPI package that provides templates for deploying OpenStack using the TripleO project. These templates define the infrastructure and services required for an OpenStack deployment.
Opendaylight is an open-source software-defined networking (SDN) controller that is used in Red Hat OpenStack Platform 13 (RHOSP13) for network management and orchestration.
Default credentials are preconfigured usernames and passwords that are set by the software developer as a convenience for initial setup. However, if these credentials are easily guessable or widely known, they can pose a security risk.
The vulnerability allows unauthorized access to Opendaylight in RHOSP13, which can lead to various consequences such as unauthorized actions within the OpenStack environment, data breaches, and disruption of services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for tripleo-heat-templates.
