CVE-2026-71195

9.9 CRITICAL

Published 2026-10-21 · Updated 2026-10-22

AI risk analysis

Summary: In OpenStack Manila before 23.0.1, public shares lack proper authorization checks during API operations, allowing any authenticated user to perform unauthorized actions (e.g., access, backup, delete) on foreign public shares by exploiting share UUIDs visible in public listings.
Exploitability: Low effort for any authenticated project member; requires only knowledge of a public share's UUID and standard Manila API calls.
Blast radius: An attacker can exfiltrate sensitive data via backups, escalate privileges through access rule manipulation, or disrupt availability by deleting or moving shares, affecting all tenants sharing public resources.
Detection: Log entries showing API calls (e.g., allow_access, create_share_backup) on public shares where the authenticated project ID does not match the share owner's project ID; monitor for unexpected access rule changes or backup creation events tied to foreign share UUIDs.
Prioritized remediation: Upgrade to OpenStack Manila 23.0.1 or later, which includes the required authorization checks for public share operations.

authorization-bypassdata-exfiltrationopenstackmanilapublic-sharecwe-863

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-863

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.