Is CVE-2015-9543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-9543 being exploited in the wild.

How severe is CVE-2015-9543?

Low severity, with a CVSS score of 3.1, published 6 July 2026.

Which products and versions are affected?

nova (PyPI) ECOSYSTEM:introduced=0,fixed=18.2.4, ECOSYSTEM:introduced=0,fixed=18.2.4,introduced=19.0.0,fixed=19.1.0,introduced=20.0.0,fixed=20.1.0.

Is there a fix for CVE-2015-9543?

Yes. nova (PyPI): upgrade to 18.2.4, 20.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-9543 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2015-9543?

Check whether you run nova (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-9543: PYSEC-2026-857 - OpenStack Nova can leak consoleauth token into log files

CVE-2015-9543 · Severity: low · CVSS 3.1 · Published 2026-07-06

OpenStack Nova is a cloud computing service that manages virtual machine instances in OpenStack deployments. The service was leaking console authentication tokens into readable log files, allowing attackers with log file access to obtain tokens needed for console access to virtual machines. This affects all Nova installations using novncproxy for remote console access.

Technologies: nova (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2015-9543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-9543 being exploited in the wild.
How severe is CVE-2015-9543?: Low severity, with a CVSS score of 3.1, published 6 July 2026.
Which products and versions are affected?: nova (PyPI) ECOSYSTEM:introduced=0,fixed=18.2.4, ECOSYSTEM:introduced=0,fixed=18.2.4,introduced=19.0.0,fixed=19.1.0,introduced=20.0.0,fixed=20.1.0.
Is there a fix for CVE-2015-9543?: Yes. nova (PyPI): upgrade to 18.2.4, 20.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-9543 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2015-9543?: Check whether you run nova (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nova (PyPI): upgrade to 18.2.4, 20.1.0 or later
```
pip install "nova>=20.1.0"
```

Technical details

The vulnerability is an information disclosure flaw (CWE-200) in OpenStack Nova's console WebSocket proxy handler that logs unmasked consoleauth tokens. The vulnerable component is NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py. An attacker with local or direct read access to Nova service logs can extract plaintext tokens used for console authentication and use them to gain unauthorized console access to virtual machines. The vulnerability affects Nova versions before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. Patches mask tokens in log output to prevent exposure.

Affected products

OpenStack Nova before 18.2.4, 19.x before 19.1.0, 20.x before 20.1.0

Identifiers

CVE-2015-9543
GHSA-22jm-4hxw-35jf
PYSEC-2026-857

Timeline

2020-02-19: disclosed
2020: patched: Fix released in Nova 18.2.4, 19.1.0, and 20.1.0
2022-05-24: advisory

References

https://github.com/openstack/nova/commit/08f1f914cc219cf526adfb08c46b8f40b4e78232

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.