Comment 20 for bug 2030976

Please take a look at the proposed impact description below. After a round of corrections I'll request a CVE assignment based on this additional information. We can amend the information later to include other affected projects (and reporters) if any are identified.

title: Authentication tokens included in notification payloads

reporters:
  - name: Scott Solkhon
    affiliation: G-Research
    reported: 'CVE-TBD'
  - name: Dan Smith
    affiliation: Red Hat
    reported: 'CVE-TBD'

affected-products:
  - product: Ironic
    version: '<20.1.2, >=20.2.0 <21.1.1, >=21.2.0 <21.4.1'
  - product: Nova
    version: '<25.2.1, >=26.0.0 <26.2.1, >=27.0.0 <27.1.1'

description: >
  Scott Solkhon with G-Research and Dan Smith with Red Hat reported
  related vulnerabilities in Ironic and Nova. Some service
  notification payloads may unnecessarily embed raw copies of
  authentication tokens, revealing those credentials to systems
  administrators who are allowed access to copies of notifications,
  allowing them to impersonate the affected accounts. Only
  deployments with notifications enabled using the AMQP or Kafka
  drivers are affected.