UNKNOWN OpenStack
CVE-2026-93852
OSSA-2026-040: Multiple authorization vulnerabilities in the Blazar V2 lease API
Rohan Das from the University of Engineering and Management, Kolkata, reported that the Blazar V2 lease API does not enforce object-level authorization on its update and delete operations. As a result, any authenticated user who knows a lease ID can modify or delete leases belonging to other users and projects. The same reporter found that the Blazar V2 lease listing operation returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated us
Affected Products
- Blazar: >=1.0.0 <15.1.1, ==16.0.0, ==17.0.0
- CVE-2026-93852
- CVE-2026-93854
References
- https://security.openstack.org/ossa/OSSA-2026-040.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-93852
- https://nvd.nist.gov/vuln/detail/CVE-2026-93854
This unknown severity vulnerability was published on 2026-09-21 via OpenStack. Affected: Blazar: >=1.0.0 <15.1.1, ==16.0.0, ==17.0.0, CVE-2026-93852, CVE-2026-93854.
vulnfeed aggregates 17711 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.