CVE-2026-40214 Details
Description
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
A vulnerability exists in the OpenStack Cyborg Accelerator Request (ARQ) API prior to version 16.0.1, where project ownership is not enforced at any level. The 'project_id' field in the database is never populated, leading to a lack of project filtering in database queries. This allows any authenticated non-admin user to delete ARQs associated with instances from other projects, causing a denial-of-service by preventing the affected VM from restarting.
Users can update to OpenStack Cyborg versions 16.0.1 or later, or apply the backported patches available for the 2024.2, 2025.1, 2025.2 and 2026.1 branches.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-282 | Improper Ownership Management | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | [email protected] |
| May 7, 2026 | New CVE Received | [email protected] |