An information leak was discovered in openstack heat. https://review.opendev.org/c/openstack/heat/+/868166 https://github.com/openstack/heat/commit/a49526c278e52823080c7f3fcb72785b93fd4dcb The get stack environment API doesn't mask hidden parameter values. A malicious system user can get sensitive data by this API even though encrypt_parameters_and_properties option is set to true. All VMs deployed by this heat template may be compromised.
Created openstack-heat tracking bugs for this issue: Affects: openstack-rdo [bug 2181623]