OpenStack Blazar Vulnerability Exposing Lease Information

CVE-2026-93852

What is CVE-2026-93852?

In OpenStack Blazar versions prior to 17.0.1, there exists a vulnerability in the V2 lease listing operation which allows authenticated users to access lease information across all projects. This flaw permits users to enumerate lease IDs, reservation IDs, resource IDs, and reservation metadata belonging to other tenants without proper project scoping or security controls. The exposure of lease IDs can lead to further security breaches, including unauthorized modifications or deletions of leases, thus posing significant risks to resource integrity and privacy.

References