Authorization Bypass in OpenStack Blazar Affecting Lease Management

CVE-2026-93854

What is CVE-2026-93854?

In OpenStack Blazar versions prior to 17.0.1, an authorization bypass vulnerability has been identified in the V2 lease API. This issue arises from the failure to properly enforce object-level authorization during update and delete operations for leases. The affected methods, namely PUT and DELETE on the /v2/leases/{lease_id} endpoint, do not correctly verify a user's ownership of a lease due to a mismatch in parameter naming between the authorization checks and the API. As a result, any authenticated user who has knowledge of a lease ID can impersonate the lease's owner and gain the ability to modify or delete any lease, exposing multiple projects to potential unauthorized changes.

References