p PatchFirst

CVE-2026-40214

CVE-2026-40214

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

CVSS 6.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cyborg

    Versions
    • ≥ 3.0.0, < 14.0.1: Affected (semver)
    • ≥ 15.0.0, < 15.0.1: Affected (semver)
    • ≥ 16.0.0, < 16.0.1: Affected (semver)

    Update to 14.0.1; Update to 15.0.1; Update to 16.0.1

  • cyborg Debian:13

    Versions
    • 14.0.0-3
    Affected ranges
    • ECOSYSTEM: < 14.0.0-3+deb13u1

    Update to 14.0.0-3+deb13u1

  • cyborg Debian:14

    Versions
    • 14.0.0-3
    • 15.0.0-1
    • 15.0.0~rc1-1
    • 15.0.0~rc1-2
    • 15.0.0~rc1-3
    • 16.0.0-1
    • 16.0.0-2
    • 16.0.0~rc1-1
    • 16.0.0~rc1-2
    • 16.0.0~rc2-1
    Affected ranges
    • ECOSYSTEM: < 16.0.0+git+2026.04.26.b8edfa06f1-1

    Update to 16.0.0+git+2026.04.26.b8edfa06f1-1

  • openstack-cyborg PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 1.0.0
    • 1.0.0.0b3
    • 1.0.0.0rc1
    • 10.0.0
    • 10.0.0.0rc1
    • 10.1.0
    • 11.0.0
    • 11.0.0.0rc1
    • 12.0.0
    • 12.0.0.0rc1
    • 13.0.0
    • 13.0.0.0rc1
    • 14.0.0
    • 14.0.0.0rc1
    • 14.1.0
    • 15.0.0
    • 15.0.0.0rc1
    • 15.0.1
    • 16.0.0
    • 16.0.0.0rc1
    • 16.0.0.0rc2
    • 2.0.0
    • 2.0.0.0rc1
    • 3.0.0
    • 3.0.0.0rc1
    • 3.0.1
    • 4.0.0
    • 4.0.0.0rc1
    • 4.0.1
    • 5.0.0
    • 5.0.0.0rc1
    • 5.0.0.0rc2
    • 5.0.1
    • 6.0.0
    • 6.0.0.0rc1
    • 6.0.0.0rc2
    • 6.0.1
    • 7.0.0
    • 7.0.0.0rc1
    • 7.0.1
    • 8.0.0
    • 8.0.0.0rc1
    • 8.0.1
    • 9.0.0
    • 9.0.0.0rc1
    Affected ranges
    • ECOSYSTEM: < 16.0.1

    Update to 16.0.1

  • cyborg Ubuntu:25.10

    Versions
    • 13.0.0-2
    • 14.0.0-2
    • 14.0.0-3
    Affected ranges
    • ECOSYSTEM: < 14.0.0-3+deb13u1build0.25.10.1

    Update to 14.0.0-3+deb13u1build0.25.10.1

  • cyborg Ubuntu:26.04:LTS

    Versions
    • 14.0.0-3
    • 15.0.0-1
    • 16.0.0~rc1-2
    • 16.0.0-2
    Affected ranges
    • ECOSYSTEM: < 16.0.0-2ubuntu0.1

    Update to 16.0.0-2ubuntu0.1

Original sources

Check your server →