p PatchFirst

CVE-2026-93856

CVE-2026-93856

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.

CVSS 4.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cinder

    Versions
    • ≥ 9.0.0, < 26.3.1: Affected (semver)
    • 27.0.0: Affected (semver)
    • 28.0.0: Affected (semver)
    • 29.0.0: Affected (semver)

    Update to 26.3.1

  • cinder Debian:12

    Versions
    • 2:21.1.0-3
    • 2:21.3.1-1~deb12u1
    • 2:22.0.0-1
    • 2:22.0.0-2
    • 2:22.0.0-3
    • 2:22.0.0-4
    • 2:22.0.0-5
    • 2:22.0.0-6
    • 2:22.0.0~rc1-1
    • 2:23.0.0-1
    • 2:23.0.0-2
    • 2:23.0.0-3
    • 2:23.0.0-4
    • 2:23.0.0~rc1-1
    • 2:24.0.0-1
    • 2:24.0.0-2
    • 2:24.0.0-3
    • 2:24.0.0-5
    • 2:24.0.0-6
    • 2:24.0.0-7
    • 2:24.0.0-8
    • 2:24.0.0~rc1-1
    • 2:25.0.0-1
    • 2:25.0.0-2
    • 2:25.0.0-3
    • 2:25.0.0-4
    • 2:25.0.0-5
    • 2:25.0.0-6
    • 2:25.0.0-7
    • 2:25.0.0~rc1-1
    • 2:25.0.0~rc1-2
    • 2:25.1.0-1
    • 2:26.0.0-1
    • 2:26.0.0-1.1
    • 2:26.0.0-2
    • 2:26.0.0~rc1-1
    • 2:26.0.0~rc1-2
    • 2:26.0.0~rc2-1
    • 2:26.0.0~rc2-2
    • 2:27.0.0-1
    • 2:27.0.0-2
    • 2:27.0.0-3
    • 2:27.0.0-4
    • 2:27.0.0-5
    • 2:27.0.0-6
    • 2:27.0.0~rc1-1
    • 2:27.0.0~rc1-2
    • 2:27.0.0~rc1-3
    • 2:28.0.0-1
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc1-3
    • 2:28.0.0~rc2-1
    • 2:29.0.0-1
    • 2:29.0.0-2
    • 2:29.0.0-3
    • 2:29.0.0~rc1-1
    • 2:29.0.0~rc1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Debian:13

    Versions
    • 2:26.0.0-2
    • 2:27.0.0-1
    • 2:27.0.0-2
    • 2:27.0.0-3
    • 2:27.0.0-4
    • 2:27.0.0-5
    • 2:27.0.0-6
    • 2:27.0.0~rc1-1
    • 2:27.0.0~rc1-2
    • 2:27.0.0~rc1-3
    • 2:28.0.0-1
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc1-3
    • 2:28.0.0~rc2-1
    • 2:29.0.0-1
    • 2:29.0.0-2
    • 2:29.0.0-3
    • 2:29.0.0~rc1-1
    • 2:29.0.0~rc1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Debian:14

    Versions
    • 2:26.0.0-2
    • 2:27.0.0-1
    • 2:27.0.0-2
    • 2:27.0.0-3
    • 2:27.0.0-4
    • 2:27.0.0-5
    • 2:27.0.0-6
    • 2:27.0.0~rc1-1
    • 2:27.0.0~rc1-2
    • 2:27.0.0~rc1-3
    • 2:28.0.0-1
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc1-3
    • 2:28.0.0~rc2-1
    • 2:29.0.0-1
    • 2:29.0.0-2
    • 2:29.0.0-3
    • 2:29.0.0~rc1-1
    • 2:29.0.0~rc1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:16.04:LTS

    Versions
    • 2:7.0.0-0ubuntu1
    • 2:8.0.0~b1-0ubuntu1
    • 2:8.0.0~b2-0ubuntu2
    • 2:8.0.0~b3-0ubuntu2
    • 2:8.0.0~rc1-0ubuntu2
    • 2:8.0.0-0ubuntu1
    • 2:8.1.0-0ubuntu1
    • 2:8.1.1-0ubuntu1
    • 2:8.1.1-0ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:Pro:18.04:LTS

    Versions
    • 2:11.0.0-0ubuntu2
    • 2:11.0.0-0ubuntu3
    • 2:12.0.0~b1-0ubuntu1
    • 2:12.0.0~b2-0ubuntu2
    • 2:12.0.0~rc1-0ubuntu1
    • 2:12.0.0~rc2-0ubuntu1
    • 2:12.0.0~rc2-0ubuntu2
    • 2:12.0.0-0ubuntu1
    • 2:12.0.1-0ubuntu1
    • 2:12.0.3-0ubuntu1
    • 2:12.0.4-0ubuntu1
    • 2:12.0.5-0ubuntu1
    • 2:12.0.7-0ubuntu2
    • 2:12.0.9-0ubuntu1
    • 2:12.0.9-0ubuntu1.2
    • 2:12.0.10-0ubuntu1
    • 2:12.0.10-0ubuntu2
    • 2:12.0.10-0ubuntu2.2
    • 2:12.0.10-0ubuntu2.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:20.04:LTS

    Versions
    • 2:15.0.0-0ubuntu1
    • 2:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu1
    • 2:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu1
    • 2:16.0.0~b3~git2020041012.eb915e2db-0ubuntu1
    • 2:16.0.0-0ubuntu0.20.04.1
    • 2:16.1.0-0ubuntu1
    • 2:16.2.0-0ubuntu1
    • 2:16.2.1-0ubuntu1
    • 2:16.2.1-0ubuntu2
    • 2:16.3.0-0ubuntu1
    • 2:16.4.0-0ubuntu1
    • 2:16.4.1-0ubuntu1
    • 2:16.4.2-0ubuntu2
    • 2:16.4.2-0ubuntu2.1
    • 2:16.4.2-0ubuntu2.2
    • 2:16.4.2-0ubuntu2.3
    • 2:16.4.2-0ubuntu2.4
    • 2:16.4.2-0ubuntu2.5
    • 2:16.4.2-0ubuntu2.6
    • 2:16.4.2-0ubuntu2.8
    • 2:16.4.2-0ubuntu2.9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:22.04:LTS

    Versions
    • 2:19.0.0-0ubuntu2
    • 2:19.0.0+git2022030310.b49fb59a6-0ubuntu1
    • 2:19.0.0+git2022030310.b49fb59a6-0ubuntu2
    • 2:20.0.0-0ubuntu1
    • 2:20.0.1-0ubuntu1
    • 2:20.1.0-0ubuntu1
    • 2:20.1.0-0ubuntu2.1
    • 2:20.1.0-0ubuntu2.2
    • 2:20.2.0-0ubuntu1
    • 2:20.2.0-0ubuntu1.1
    • 2:20.3.0-0ubuntu1
    • 2:20.3.1-0ubuntu1
    • 2:20.3.1-0ubuntu1.1
    • 2:20.3.1-0ubuntu1.2
    • 2:20.3.1-0ubuntu1.4
    • 2:20.3.1-0ubuntu1.5
    • 2:20.3.1-0ubuntu1.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:24.04:LTS

    Versions
    • 2:23.0.0-0ubuntu1
    • 2:23.0.0-0ubuntu3
    • 2:23.0.0+git2024011915.b8cd101f-0ubuntu1
    • 2:23.0.0+git2024011915.b8cd101f-0ubuntu2
    • 2:24.0.0~rc1-0ubuntu1
    • 2:24.0.0-0ubuntu1
    • 2:24.0.0-0ubuntu1.2
    • 2:24.0.0-0ubuntu1.3
    • 2:24.2.0-0ubuntu1
    • 2:24.2.0-0ubuntu2
    • 2:24.2.0-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:26.10

    Versions
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0+git20260815.248.2a29bac-0ubuntu1
    • 2:29.0.0~rc1-0ubuntu1
    • 2:29.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:26.04:LTS

    Versions
    • 2:27.0.0-0ubuntu1
    • 2:28.0.0~rc1-0ubuntu2
    • 2:28.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →