CVE-2026-40213

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://bugs.launchpad.net/openstack-cyborg/+bug/2143263
https://security.openstack.org/ossa/OSSA-2026-011.html
https://www.openwall.com/lists/oss-security/2026/05/07/6

Configurations

No configuration.

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) OpenStack Cyborg anterior a la versión 16.0.1 utiliza la regla:allow (check_str=’@’) como política predeterminada para múltiples puntos finales de API. Esto autoriza incondicionalmente cualquier solicitud que lleve un token de Keystone válido, independientemente de los roles, la pertenencia al proyecto o el alcance. Un usuario autenticado sin asignaciones de rol puede completar varias acciones, como la reprogramación de bitstreams de FPGA en nodos de cómputo arbitrarios a través de RPC de agente.

Information

Published : 2026-05-07 22:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-40213

Mitre link : CVE-2026-40213

CVE.ORG link : CVE-2026-40213

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-40213", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40213", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T13:55:42.638626Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "OpenStack", "product": "Cyborg", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "14.0.1", "versionType": "semver"}, {"status": "affected", "version": "15.0.0", "lessThan": "15.0.1", "versionType": "semver"}, {"status": "affected", "version": "16.0.0", "lessThan": "16.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T22:16:34.910", "references": [{"url": "https://bugs.launchpad.net/openstack-cyborg/+bug/2143263", "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-011.html", "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/05/07/6", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC."}, {"lang": "es", "value": "OpenStack Cyborg anterior a la versi\u00f3n 16.0.1 utiliza la regla:allow (check_str=\u2019@\u2019) como pol\u00edtica predeterminada para m\u00faltiples puntos finales de API. Esto autoriza incondicionalmente cualquier solicitud que lleve un token de Keystone v\u00e1lido, independientemente de los roles, la pertenencia al proyecto o el alcance. Un usuario autenticado sin asignaciones de rol puede completar varias acciones, como la reprogramaci\u00f3n de bitstreams de FPGA en nodos de c\u00f3mputo arbitrarios a trav\u00e9s de RPC de agente."}], "lastModified": "2026-10-26T00:10:00.150", "sourceIdentifier": "cve@mitre.org"}