id: PYSEC-2026-1214
published: "2026-07-07T11:45:24.958611Z"
modified: "2026-07-07T17:23:49.473128Z"
aliases:
- CVE-2023-1636
- GHSA-6rx9-c2rh-3qv4
summary: OpenStack Barbican information disclosure vulnerability
details: A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
affected:
- package:
    name: barbican
    ecosystem: PyPI
    purl: pkg:pypi/barbican
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 16.0.0
  versions:
  - "0"
  - 10.0.0
  - 10.0.0.0rc1
  - 10.1.0
  - 11.0.0
  - 11.0.0.0rc1
  - 12.0.0
  - 12.0.0.0rc1
  - 12.0.0.0rc2
  - 12.0.1
  - 12.0.2
  - 13.0.0
  - 13.0.0.0rc1
  - 13.0.1
  - 13.0.2
  - 14.0.0
  - 14.0.0.0rc1
  - 14.0.1
  - 14.0.2
  - 15.0.0
  - 15.0.0.0rc1
  - 15.0.0.0rc2
  - 15.0.0.0rc3
  - 15.0.1
  - 16.0.0
  - 16.0.0.0rc1
  - 6.0.0.0b1
  - 8.0.0
  - 8.0.0.0rc1
  - 8.0.1
  - 9.0.0
  - 9.0.0.0rc1
  - 9.0.1
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-1636
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2023-1636
- type: WEB
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2181765
- type: PACKAGE
  url: https://github.com/openstack/barbican
- type: PACKAGE
  url: https://pypi.org/project/barbican
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6rx9-c2rh-3qv4
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L