CVE-2026-93852

HighCVSS 7.1

Published: 18/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

In OpenStack Blazar before 17.0.1, the V2 lease listing operation returns leases for every project without enforcing project scoping or administrator-only policy. Any authenticated user can enumerate leases of other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata.

Risk Assessment

Exposure of lease IDs and metadata could enable further attacks, including modification or deletion of other users' leases.

Recommendation

Upgrade OpenStack Blazar to version 17.0.1 or later, which enforces proper access restrictions.

Other vulnerabilities in OpenStack Blazar

CVE-2026-93854High
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on update and delete operations. Due to a parameter naming error, authorization does not check the lease owner, allowing any authenticated user to modify or delete leases belonging to other users.

Original NVD description (English source)

In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS