Information leakage in YAQL

MEDIUM 6.5CVE-2024-29156 · GHSA-mvf6-hwxh-7v76 · PYSEC-2026-2059 · Published 18/03/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
yaql PyPI	`< 3.0.0`	`3.0.0`
murano openstack	`≤ 16.0.0`	No fix yet
yaql openstack	`< 3.0.0`	`3.0.0`

Description

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

NVD description

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

References

nvd.nist.gov/vuln/detail/CVE-2024-29156 · ADVISORY
bugs.launchpad.net/murano/+bug/2048114 · WEB
launchpad.net/bugs/2048114 · WEB
opendev.org/openstack/murano/tags · WEB
opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3 · WEB
wiki.openstack.org/wiki/OSSN/OSSN-0093 · WEB
pypi.org/project/yaql · PACKAGE
GitHub Advisory GHSA-mvf6-hwxh-7v76 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free