p PatchFirst

CVE-2026-40213

CVE-2026-40213

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

CVSS 7.4 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cyborg

    Versions
    • ≥ 5.0.0, < 14.0.1: Affected (semver)
    • ≥ 15.0.0, < 15.0.1: Affected (semver)
    • ≥ 16.0.0, < 16.0.1: Affected (semver)

    Update to 14.0.1; Update to 15.0.1; Update to 16.0.1

  • cyborg Debian:13

    Versions
    • 14.0.0-3
    Affected ranges
    • ECOSYSTEM: < 14.0.0-3+deb13u1

    Update to 14.0.0-3+deb13u1

  • cyborg Debian:14

    Versions
    • 14.0.0-3
    • 15.0.0-1
    • 15.0.0~rc1-1
    • 15.0.0~rc1-2
    • 15.0.0~rc1-3
    • 16.0.0-1
    • 16.0.0-2
    • 16.0.0~rc1-1
    • 16.0.0~rc1-2
    • 16.0.0~rc2-1
    Affected ranges
    • ECOSYSTEM: < 16.0.0+git+2026.04.26.b8edfa06f1-1

    Update to 16.0.0+git+2026.04.26.b8edfa06f1-1

  • openstack-cyborg PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 1.0.0
    • 1.0.0.0b3
    • 1.0.0.0rc1
    • 10.0.0
    • 10.0.0.0rc1
    • 10.1.0
    • 11.0.0
    • 11.0.0.0rc1
    • 12.0.0
    • 12.0.0.0rc1
    • 13.0.0
    • 13.0.0.0rc1
    • 14.0.0
    • 14.0.0.0rc1
    • 14.1.0
    • 15.0.0
    • 15.0.0.0rc1
    • 15.0.1
    • 16.0.0
    • 16.0.0.0rc1
    • 16.0.0.0rc2
    • 2.0.0
    • 2.0.0.0rc1
    • 3.0.0
    • 3.0.0.0rc1
    • 3.0.1
    • 4.0.0
    • 4.0.0.0rc1
    • 4.0.1
    • 5.0.0
    • 5.0.0.0rc1
    • 5.0.0.0rc2
    • 5.0.1
    • 6.0.0
    • 6.0.0.0rc1
    • 6.0.0.0rc2
    • 6.0.1
    • 7.0.0
    • 7.0.0.0rc1
    • 7.0.1
    • 8.0.0
    • 8.0.0.0rc1
    • 8.0.1
    • 9.0.0
    • 9.0.0.0rc1
    Affected ranges
    • ECOSYSTEM: < 16.0.1

    Update to 16.0.1

  • cyborg Ubuntu:25.10

    Versions
    • 13.0.0-2
    • 14.0.0-2
    • 14.0.0-3
    Affected ranges
    • ECOSYSTEM: < 14.0.0-3+deb13u1build0.25.10.1

    Update to 14.0.0-3+deb13u1build0.25.10.1

  • cyborg Ubuntu:26.04:LTS

    Versions
    • 14.0.0-3
    • 15.0.0-1
    • 16.0.0~rc1-2
    • 16.0.0-2
    Affected ranges
    • ECOSYSTEM: < 16.0.0-2ubuntu0.1

    Update to 16.0.0-2ubuntu0.1

Original sources

Check your server →