QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-40214

Back to search

CVE-2026-40214

Published: May 7, 2026

Modified: May 8, 2026

PUBLISHED

CVSS v3.1

6.3

MEDIUM

Description

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

VendorProductVersions

OpenStack

Cyborg

affected
3.0.0 - < 14.0.1
affected
15.0.0 - < 15.0.1
affected
16.0.0 - < 16.0.1

Weaknesses (CWE)

CWE-282

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now