Project Ownership Flaw in OpenStack Cyborg Affects API Functionality

CVE-2026-40214

What is CVE-2026-40214?

A serious vulnerability in OpenStack Cyborg, prior to version 16.0.1, arises from a lack of enforced project ownership in the Accelerator Request (ARQ) API. The absence of population in the project_id column leads to NULL entries for all ARQs, creating a significant risk where database queries are executed without appropriate project filtering. As a result, an authenticated non-admin user can perform actions, including deleting ARQs associated with instances from other projects, enabling potential cross-tenant denial of service attacks. This flaw highlights the necessity for rigorous access control mechanisms within API frameworks.

References