UNKNOWN OpenStack
CVE-2026-71195
OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes
Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that a non-owner could modify access rules and export-location metadata of another project’s public share. Goutham Pacha Ravi and Carlos da Silva from Red Hat identified further public-share paths: a non-owner could soft-delete or restore a foreign public share, or create a backup of it. A compatible storage backend may apply unauthorized changes to existing access rules, disrupting access for the share
Affected Products
- Manila: >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0
- CVE-2026-71195
References
- https://security.openstack.org/ossa/OSSA-2026-046.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-71195
This unknown severity vulnerability was published on 2026-10-20 via OpenStack. Affected: Manila: >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0, CVE-2026-71195.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.