Skip to content
Fencer Vulns
critical 9.9

CVE-2026-71195 json

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.

published 2026-10-21 19 d ago modified 2026-10-27 12 d ago also EUVD-2026-107046

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Patch / fix

  • OpenStack Manila 20.0.3, 21.0.3, 22.0.2, 23.0.1
  • manila Debian 14 1:23.0.0-4

debian advisories DEBIAN-CVE-2026-71195

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-71195 updated cvss 8.8

manila: manila: Public Manila Share Allows Cross-Project Access-Rule and Export-Metadata Writes

  • Red Hat OpenStack Platform 13 (Queens) python-manila, openstack-manila, python-manila-tests, openstack-manila-share
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.2 python3-manila, openstack-manila, openstack-manila-share Red Hat OpenStack Platform 17.1 python3-manila, openstack-manila, openstack-manila-share Red Hat OpenStack Platform 18.0 openstack-manila
    affected: no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
12 d ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.launchpad.net https://bugs.launchpad.net/ossa/+bug/2161412 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • OpenStack Manila

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.