CVE-2026-40213 json
OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
published 2026-05-07 6 mo ago modified 2026-10-26 14 d ago also GHSA-mm7j-mhhj-hj36 , PYSEC-2026-2853 , EUVD-2026-28455
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.
Patch / fix
- pypi openstack-cyborg 16.0.1
- OpenStack Cyborg 14.0.1, 15.0.1, 16.0.1
- cyborg Debian 13 14.0.0-3+deb13u1
- cyborg Debian 14 16.0.0+git+2026.04.26.b8edfa06f1-1
debian advisories DEBIAN-CVE-2026-40213
- cyborg Ubuntu 25.10 14.0.0-3+deb13u1build0.25.10.1
- cyborg Ubuntu 26.04 LTS 16.0.0-2ubuntu0.1
ubuntu advisories UBUNTU-CVE-2026-40213
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
| OSV | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | openstack-cyborg | <16.0.1 |
16.0.1 |
Affected products
- OpenStack Cyborg
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
bugs.launchpad.net
/openstack-cyborg/+bug/2143263
web
-
openwall.com
/lists/oss-security/2026/05/07/6
web
-
security.openstack.org
/ossa/OSSA-2026-011.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-40213
advisory
-
github.com
/openstack/cyborg
package
-
pypi.org
/project/openstack-cyborg
package
-
github.com
/advisories/GHSA-mm7j-mhhj-hj36
advisory
Sources
- CVE List CVE-2026-40213
- GitHub Advisory GHSA-mm7j-mhhj-hj36
- NVD CVE-2026-40213
- OSV PYSEC-2026-2853
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.