UNKNOWN OpenStack
CVE-2026-40213
OSSA-2026-011: Multiple access control vulnerabilities in Cyborg accelerator management
Sean Mooney from Red Hat reported multiple access control vulnerabilities in OpenStack Cyborg. Default policy rules for device, deployable, and attribute API endpoints use an unconditional allow check that grants access to any authenticated user regardless of roles or project scope (CVE-2026-40213). Separately, Accelerator Request (ARQ) resources lack project ownership enforcement, allowing any authenticated user to enumerate, delete, or manipulate ARQs belonging to other projects (CVE-2026-4021
Affected Products
- Cyborg: >=3.0.0 <14.0.1, >=15.0.0 <15.0.1, >=16.0.0 <16.0.1
- CVE-2026-40213
- CVE-2026-40214
References
- https://security.openstack.org/ossa/OSSA-2026-011.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-40213
- https://nvd.nist.gov/vuln/detail/CVE-2026-40214
This unknown severity vulnerability was published on 2026-05-07 via OpenStack. Affected: Cyborg: >=3.0.0 <14.0.1, >=15.0.0 <15.0.1, >=16.0.0 <16.0.1, CVE-2026-40213, CVE-2026-40214.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.