PT-2026-38597 · Openstack · Openstack Cyborg

Sean Mooney · Published 2026-05-07 · Updated 2026-05-09 · CVE-2026-40214

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenStack Cyborg versions prior to 16.0.1

Description The Accelerator Request (ARQ) API fails to enforce project ownership. The project id database column remains unpopulated, database queries lack project filtering, and policy checks are self-referential because the authorize wsgi function compares the caller's project id with itself instead of the target resource. This allows any authenticated non-admin user to perform actions, such as deleting ARQs associated with instances from other projects, leading to a cross-tenant denial of service.

Recommendations Update to version 16.0.1.

Fix

DoS

Weakness Enumeration

CWE-282

Related Identifiers

CVE-2026-40214

GHSA-MMPC-XJXR-5HF8

Affected Products

Openstack Cyborg

References · 14

• https://ubuntu.com/security/CVE-2026-40214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40214 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40214 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40214 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40214 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmpc-xjxr-5hf8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40214 · Vendor Advisory
• https://github.com/openstack/cyborg · Note
• https://security.openstack.org/ossa/OSSA-2026-011.html · Note
• https://openwall.com/lists/oss-security/2026/05/07/6 · Note
• https://bugs.launchpad.net/openstack-cyborg/+bug/2144056 · Note
• https://t.me/CVEtracker/53035 · Telegram Post
• https://t.me/cveNotify/162736 · Telegram Post
• https://twitter.com/oss_security/status/2052943749873840565 · Twitter Post