Authorization Flaw in OpenStack Cyborg by OpenStack

CVE-2026-40213

What is CVE-2026-40213?

OpenStack Cyborg, prior to version 16.0.1, is prone to an authorization vulnerability due to its default policy configuration allowing unrestricted access to multiple API endpoints. This security oversight permits any authenticated user with a valid Keystone token to execute actions without appropriate role permissions, including the capacity to reprogram FPGA bitstreams on any compute node. The flaw arises from a default allowance for requests that compromises the integrity and security of the service.

References