Privilege Escalation Vulnerability in OpenStack Manila
CVE-2026-71195

9.9CRITICAL

Key Information:

Vendor

Openstack
Status
Manila
Vendor
CVE Published:
21 October 2026

What is CVE-2026-71195?

In OpenStack Manila prior to version 23.0.1, a flaw allows multiple API operations on public shares without proper ownership verification. The affected API controllers operate based on the caller's project context, failing to authenticate the ownership of the target share. This oversight enables authenticated users to manipulate operations such as granting and revoking access, escalating access levels, and even exfiltrating data through share backups. Such vulnerabilities endanger the integrity of data, as any authenticated project member can exploit these operations on public shares, revealing sensitive information associated with the share.

Affected Version(s)

Manila 1.0.0 < 20.0.3

Manila 21.0.0 < 21.0.3

Manila 22.0.0 < 22.0.2

References

https://launchpad.net/bugs/2161412
issue-tracking
https://openwall.com/lists/oss-security/2026/10/20/18
mailing-listvendor-advisory
https://security.openstack.org/ossa/OSSA-2026-046.html
vendor-advisory

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.