CVE-2013-0266

A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.

• CWE-276
• CWE-362

• http://rhn.redhat.com/errata/RHSA-2013-0595.htmlVendor Advisory
• https://access.redhat.com/security/cve/CVE-2013-0266
• https://bugzilla.redhat.com/show_bug.cgi?id=908581
• https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc
• http://rhn.redhat.com/errata/RHSA-2013-0595.htmlVendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=908581
• https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc

Published

Mar 8, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0260Unspecified vulnerability in the Drush Debian Packaging modu…
• CVE-2013-0261A flaw was found in PackStack. A local user could exploit a …8.8
• CVE-2013-0262rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4…
• CVE-2013-0263Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x befo…
• CVE-2013-0264An import error was introduced in Cumin in the code refactor…7.5
• CVE-2013-0265The redirect_stderr function in xnbd_common.c in xnbd-server…
• CVE-2013-0267The Privileges portion of the web GUI and the XMLRPC API in …
• CVE-2013-0268The msr_open function in arch/x86/kernel/msr.c in the Linux …
• CVE-2013-0269The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x bef…
• CVE-2013-0270A flaw was found in OpenStack Keystone. A remote attacker co…6.5
• CVE-2013-0271The MXit protocol plugin in libpurple in Pidgin before 2.10.…
• CVE-2013-0272Buffer overflow in http.c in the MXit protocol plugin in lib…