PT-2026-53511 · Pypi · Murano

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

Exploit

Fix

Related Identifiers

PYSEC-2026-429

Affected Products

Murano

References · 12

• 🔥 https://github.com/openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/notes/safeloader-cve-2016-4972-19035a2a091ec30a.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4972 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-429 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/python-muranoclient/PYSEC-2016-22.yaml · Note
• https://github.com/openstack/murano · Note
• https://github.com/openstack/murano/commit/28de8c36c9dbe4aaf4d062e6fb6099afd437f49b · Note
• https://github.com/openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po · Note
• https://pypi.org/project/murano · Note
• https://bugs.launchpad.net/murano/+bug/1586079 · Note
• https://bugs.launchpad.net/python-muranoclient/+bug/1586078 · Note
• https://github.com/advisories/GHSA-87r7-q54j-f9qg · Note
• http://openwall.com/lists/oss-security/2016/06/23/8 · Note