CVE-2026-40214
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource).
Risk Assessment
Any authenticated non-admin user can perform various actions such as deleting ARQs bound to other projects' instances, resulting in cross-tenant denial of service.
Recommendation
Upgrade OpenStack Cyborg to version 16.0.1 or later. Until patched, restrict access to the ARQ API and monitor for unusual ARQ operations.
Other vulnerabilities in OpenStack Cyborg
Original NVD description (English source)
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS