id: PYSEC-2026-1213
published: "2026-07-07T11:45:25.037925Z"
modified: "2026-07-07T17:23:49.417851Z"
aliases:
- CVE-2023-1633
- GHSA-6qqp-4vm3-359v
summary: OpenStack Barbican credential leak flaw
details: A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.
affected:
- package:
    name: barbican
    ecosystem: PyPI
    purl: pkg:pypi/barbican
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 16.0.0
  versions:
  - "0"
  - 10.0.0
  - 10.0.0.0rc1
  - 10.1.0
  - 11.0.0
  - 11.0.0.0rc1
  - 12.0.0
  - 12.0.0.0rc1
  - 12.0.0.0rc2
  - 12.0.1
  - 12.0.2
  - 13.0.0
  - 13.0.0.0rc1
  - 13.0.1
  - 13.0.2
  - 14.0.0
  - 14.0.0.0rc1
  - 14.0.1
  - 14.0.2
  - 15.0.0
  - 15.0.0.0rc1
  - 15.0.0.0rc2
  - 15.0.0.0rc3
  - 15.0.1
  - 16.0.0
  - 16.0.0.0rc1
  - 6.0.0.0b1
  - 8.0.0
  - 8.0.0.0rc1
  - 8.0.1
  - 9.0.0
  - 9.0.0.0rc1
  - 9.0.1
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-1633
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2023-1633
- type: WEB
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2181761
- type: PACKAGE
  url: https://github.com/openstack/barbican
- type: PACKAGE
  url: https://pypi.org/project/barbican
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6qqp-4vm3-359v
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L