CVE-2022-3261

What it actually does

During OpenStack overcloud updates, multiple components write plain-text passwords directly into /var/log/messages, exposing credentials in system logs.

Why it matters to the business

Anyone with access to the affected log files can obtain valid credentials, raising the risk of unauthorized access, account compromise, and broader service or data exposure.

How an attack unfolds

An attacker obtains read access to /var/log/messages on an OpenStack node, locates password strings written during an overcloud update run, extracts the credentials, and uses them to authenticate against OpenStack APIs or dependent systems.

How to fix it

Configure OpenStack logging to redact or omit sensitive values, apply any available updates that prevent credential disclosure in logs, and rotate any passwords that may have been exposed in existing logs.

How to confirm the fix worked

Inspect recent /var/log/messages entries generated during overcloud updates to confirm absence of password strings; verify logging configuration files enforce masking of sensitive fields.

Typical attack path

1. Obtain read access to /var/log/messages on an OpenStack compute or controller node
2. Search logs for password strings emitted during overcloud update execution
3. Extract usable credentials from the log entries
4. Authenticate to OpenStack services or downstream systems with the recovered passwords

How to detect it

Search /var/log/messages and related log files for patterns such as password= or clear-text credential strings around the timestamps of overcloud update runs; review file-access timestamps and audit logs for unexpected reads of these files.

• /var/log/messages containing strings such as password= or auth_url with embedded credentials
• Log entries timestamped during overcloud update runs that include plain-text passwords
• Unusual read access to /var/log/messages by non-root processes

What your security team should do

• Immediately review and sanitize or rotate any credentials found in existing logs
• Enforce log redaction rules across all OpenStack nodes
• Restrict file-system permissions on /var/log/messages to least-privilege access
• Audit authentication logs for use of credentials that appeared in update logs