PT-2026-38596 · Openstack · Openstack Cyborg

Sean Mooney · Published 2026-05-07 · Updated 2026-05-09 · CVE-2026-40213

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenStack Cyborg versions prior to 16.0.1

Description Multiple API endpoints use rule:allow (check str='@') as the default policy, which unconditionally authorizes any request containing a valid Keystone token. This occurs regardless of the user's roles, project membership, or scope. Consequently, an authenticated user with no assigned roles can perform various actions, including reprogramming FPGA (Field Programmable Gate Array) bitstreams on arbitrary compute nodes via agent RPC (Remote Procedure Call).

Recommendations Update to version 16.0.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-40213

GHSA-MM7J-MHHJ-HJ36

Affected Products

Openstack Cyborg

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40213 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40213 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40213 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40213 · Security Note
• https://osv.dev/vulnerability/GHSA-mm7j-mhhj-hj36 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40213 · Vendor Advisory
• https://github.com/openstack/cyborg · Note
• https://security.openstack.org/ossa/OSSA-2026-011.html · Note
• https://openwall.com/lists/oss-security/2026/05/07/6 · Note
• https://t.me/cveNotify/162735 · Telegram Post
• https://t.me/CVEtracker/53034 · Telegram Post
• https://bugs.launchpad.net/openstack-cyborg/+bug/2143263 · Note
• https://twitter.com/oss_security/status/2052943749873840565 · Twitter Post