CVE-2020-10755: Insecure Credentials Exposure in OpenStack Cinder
Summary
CVE-2020-10755: An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before... Affects cinder across 3 version ranges.
< 14.1.0
>= 15.0.0, < 15.2.0
>= 16.0.0, < 16.1.0
Fixed in 14.1.0, 15.2.0 or 16.1.0, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-10755 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Cinder is an open-source block storage service that provides persistent block storage to virtual machines. It is a component of the OpenStack cloud computing platform and is widely used in cloud environments. The Dell EMC ScaleIO or VxFlex OS backend storage driver is one of the supported drivers in OpenStack Cinder, allowing users to utilize ScaleIO or VxFlex OS as the underlying storage solution. This vulnerability affects all versions of OpenStack Cinder prior to 14.1.0, 15.x.x versions prior to 15.2.0, and 16.x.x versions prior to 16.1.0.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10755, is an insecure-credentials flaw that exposes credentials for the entire backend in the connection_info element of Block Storage v3 Attachments API calls. When using OpenStack Cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, an attacker can create a volume and make an API call to retrieve the attachment detail information. This information includes a username and password that can be used to connect to another user's volume. Furthermore, these credentials can also be used to access the ScaleIO or VxFlex OS Management API if the attacker discovers the Management API endpoint. This vulnerability poses a significant security risk as it allows unauthorized access to sensitive data and resources.
How To Fix
Latest published version: 29.0.0 as of 22 Oct 2026
pip install --upgrade "cinder==29.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 14.1.014.1.0pip install --upgrade "cinder==14.1.0" -
>= 15.0.0, < 15.2.015.2.0pip install --upgrade "cinder==15.2.0" -
>= 16.0.0, < 16.1.016.1.0pip install --upgrade "cinder==16.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of OpenStack Cinder.
Conclusion
In conclusion, the insecure-credentials flaw in OpenStack Cinder versions prior to 14.1.0, 15.x.x versions prior to 15.2.0, and 16.x.x versions prior to 16.1.0 exposes backend credentials, allowing unauthorized access to other users' volumes and potentially the ScaleIO or VxFlex OS Management API. It is crucial for users to upgrade to the fixed versions of OpenStack Cinder to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cinder →
FAQ
OpenStack Cinder is an open-source block storage service that provides persistent block storage to virtual machines in cloud environments.
The Dell EMC ScaleIO or VxFlex OS backend storage driver is a supported driver in OpenStack Cinder that allows users to utilize ScaleIO or VxFlex OS as the underlying storage solution.
This vulnerability exposes backend credentials in the connection_info element of Block Storage v3 Attachments API calls, enabling unauthorized access to other users' volumes and potentially the ScaleIO or VxFlex OS Management API.
The exposure of backend credentials can lead to unauthorized access to sensitive data and resources, compromising the security and integrity of the affected OpenStack Cinder deployment.
To fix this vulnerability, upgrade to the patched versions of OpenStack Cinder: version 14.1.0 or later, version 15.2.0 or later, or version 16.1.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for cinder.
