Описание
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 16.0.0+git+2026.04.26.b8edfa06f1-1 |
| esm-apps/resolute | released | 16.0.0-2ubuntu0.1 |
| jammy | DNE | |
| noble | DNE | |
| questing | released | 14.0.0-3+deb13u1build0.25.10.1 |
| resolute | released | 16.0.0-2ubuntu0.1 |
| upstream | needs-triage |
Показывать по
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API d ...
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
EPSS
6.3 Medium
CVSS3