CVEvulnerability

CVE-2026-40213

7.4 HIGH Published 2026-05-07 Modified 2026-10-26 Official page ↗
Status
Awaiting Analysis
Published
2026-05-07
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-863

Description

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References