CVE-2026-40214
Publication date 7 May 2026
Last updated 9 June 2026
Ubuntu priority
Description
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cyborg | 26.04 LTS resolute |
Fixed 16.0.0-2ubuntu0.1
|
| 25.10 questing |
Fixed 14.0.0-3+deb13u1build0.25.10.1
|
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
Related Ubuntu Security Notices (USN)
- USN-8413-1
- Cyborg vulnerabilities
- 9 June 2026