CVE-2016-4972: OpenStack Murano Improper Use of Loaders Remote Code Execution
Summary
CVE-2016-4972: OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka)... Affects python-muranoclient across 2 version ranges.
< 0.7.3
>= 0.8, < 0.8.5
Fixed in 0.7.3 or 0.8.5, depending on the release line you run. How to fix ↓
Also tracked for
- murano-dashboard · PyPI
- murano · PyPI
- murano · PyPI
- murano · Debian:11
The same CVE-2016-4972 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenStack Murano is an application catalog service that provides a framework for deploying applications in an OpenStack environment. It allows users to easily deploy pre-configured applications and services on their OpenStack cloud. Murano-dashboard is the web-based user interface for managing and deploying applications using Murano. python-muranoclient is a Python library that provides a client interface for interacting with the Murano API. These components are used in OpenStack deployments to enable application deployment and management.
Vulnerability Detail
The vulnerability (CVE-2016-4972) exists in OpenStack Murano, Murano-dashboard, and python-muranoclient. These components improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files. This allows remote attackers to create arbitrary Python objects and execute arbitrary code by exploiting crafted extended YAML tags in UI definitions in packages. An attacker could exploit this vulnerability to execute malicious code on the affected system, potentially leading to unauthorized access, data loss, or other malicious activities.
How To Fix
Latest published version: 2.8.0 as of 22 Oct 2026
pip install --upgrade "python-muranoclient==2.8.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.7.30.7.3pip install --upgrade "python-muranoclient==0.7.3" -
>= 0.8, < 0.8.50.8.5pip install --upgrade "python-muranoclient==0.8.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the necessary patches or upgrades as mentioned in the 'how_to_fix' section to mitigate the risk of exploitation.
Conclusion
The vulnerability (CVE-2016-4972) in OpenStack Murano, Murano-dashboard, and python-muranoclient allows remote attackers to execute arbitrary code by exploiting crafted extended YAML tags. Users are advised to upgrade to the patched versions mentioned in the 'how_to_fix' section to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-muranoclient →
FAQ
OpenStack Murano is an application catalog service that allows users to deploy pre-configured applications and services on their OpenStack cloud.
Murano-dashboard is the web-based user interface for managing and deploying applications using OpenStack Murano.
python-muranoclient is a Python library that provides a client interface for interacting with the Murano API.
The vulnerability occurs due to the improper use of loaders inherited from yaml.Loader when parsing MuranoPL and UI files, allowing remote attackers to execute arbitrary code.
Exploiting this vulnerability could lead to unauthorized access, data loss, or other malicious activities on the affected system.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
