Critical
Security advisory
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4972
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:21 UTC · Revision 1
Source evidence
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
osv:CVE-2016-4972
Complete source record
{
"id": "0e1f7bc7dc824c4998e54fcc26a9a29b8628d88a2f7bf2f5600cd5805905dd93",
"url": "https://osv.dev/vulnerability/CVE-2016-4972",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4972",
"summary": "OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.",
"evidence": "osv:CVE-2016-4972",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-4972",
"aliases": [
"CVE-2016-4972",
"GHSA-87r7-q54j-f9qg",
"PYSEC-2016-22",
"PYSEC-2026-429",
"PYSEC-2026-430"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openstack-archive/murano",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "dccf9ca767ff0d9112116adce25824063e08e581"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openstack:murano:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.0.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.0.2",
"1.0.1",
"1.0.0.0rc1",
"1.0.0.0b3",
"1.0.0.0b2",
"1.0.0.0b1",
"1.0.0a0",
"2015.1.0rc1",
"2015.1.0b1",
"2015.1.0b3",
"2015.1.0b2",
"2014.2.rc2",
"2014.2.rc1",
"2014.2.b3",
"2014.2.b2",
"2014.2.b1",
"i4",
"iteration3-code-freeze"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4972.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/openstack-archive/murano-dashboard",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "8fea820ab89daa520a1e737f2750d58c144d7976"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openstack:murano-dashboard:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.0.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.0.2",
"1.0.1",
"1.0.0.0rc1",
"1.0.0.0b3",
"1.0.0.0b2",
"1.0.0.0b1",
"1.0.0a0",
"2015.1.0rc1",
"2015.1.0b3",
"2015.1.0b2",
"2015.1.0b1",
"2014.2.rc1",
"2014.2.b3",
"2014.2.b2",
"2014.2.b1",
"0.5.0",
"i4",
"iteration3-code-freeze"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4972.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/openstack-archive/python-muranoclient",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "15a5de4be50ebe638f8568da6b7d7c8c2febf579"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openstack:python-muranoclient:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.7.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"0.7.2",
"0.7.1",
"0.7.0",
"0.6.3",
"0.6.2",
"0.6.1.0",
"0.5.5",
"0.6.0",
"0.5.6",
"0.5.4",
"0.5.3",
"0.5.2",
"0.5.1",
"0.5.0.a1",
"0.5.0",
"i4",
"iteration3-code-freeze"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4972.json"
}
}
],
"modified": "2026-10-24T10:30:27.570366084Z",
"provider": "osv",
"references": [
"https://bugs.launchpad.net/murano/+bug/1586079",
"https://bugs.launchpad.net/python-muranoclient/+bug/1586078"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:openstack:mitaka-murano:*:*:*:*:*:*:*:*"
],
"vendor_product": "openstack:mitaka-murano",
"extracted_events": [
{
"range": [
{
"last_affected": "2.0.0"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-4972",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431862,
"published_at": "2016-09-26T16:59:01.21+00:00"
}