Cross-Project Information Disclosure in OpenStack Cinder

CVE-2026-93856

What is CVE-2026-93856?

In OpenStack Cinder versions prior to 29.0.0, a vulnerability exists in the Messages API that allows non-administrative users with project-scoped roles, such as 'member' or 'reader', to inadvertently access sensitive information from other projects. By performing a 'List messages' call via the Block Storage API v3.3, these users can receive non-expired messages intended for other projects along with their UUIDs, which compromises the security and confidentiality of the sensitive data. All deployments of Cinder are susceptible to this issue, emphasizing the necessity for prompt mitigation.

References