Detections
Analytics

Chainguard: openstack-rally-2026.1: security update to 4.1.0-r4

high Tenable Cloud Security Plugin ID 476642

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2,
 ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete
 activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__
 inside an already substituted and quoted environment path or prompt can be replaced during a later pass.
 The later value's quoting can close the earlier literal and execute the remaining path when a user
 activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display
 token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command
 execution. The attacker must influence the destination path or --prompt, and a value without a relevant
 placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.
 (CVE-2026-113776)

Solution

Update the openstack-rally-2026.1 library and its related packages to version 4.1.0-r4 or later.

Plugin Details

Severity: High

ID: 476642

Version: Revision 1.1

Type: Local

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.48

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-113776

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-113776