Read the docs
TI-2026-78562 Aliases CVE-2026-71195GHSA-xm2x-8fhq-8hpv

Incorrect authorization in OpenStack Manila share operations

Priority HIGH 76CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

OpenStack Manila from 1.0.0 before 20.0.3, from 21.0.0 before 21.0.3, from 22.0.0 before 22.0.2 and from 23.0.0 before 23.0.1 is affected. Several API operations on public shares load a share from another project without checking its owner (CWE-863). Any authenticated project member can change access to, back up, or delete another tenant's public share, and read its access rules.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00484 41st percentileScored 2026-11-07
Fix Partial Manila (OpenStack): 20.0.3, 21.0.3, 22.0.2 +1Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackManila1.0.0 to before 20.0.3; 21.0.0 to before 21.0.3; 22.0.0 to before 22.0.2; 23.0.0 to before 23.0.120.0.3, 21.0.3, 22.0.2, 23.0.1Patch availableCNA
  • Manila VendorOpenStack Affected 1.0.0 to before 20.0.3; 21.0.0 to before 21.0.3; 22.0.0 to before 22.0.2; 23.0.0 to before 23.0.1 Fixed in 20.0.3, 21.0.3, 22.0.2, 23.0.1 Patch available CNA

Remediation

Upgrade OpenStack Manila to 20.0.3, 21.0.3, 22.0.2 or 23.0.1. Red Hat's plan for Red Hat OpenStack Platform 13 (Queens) is no fix planned, and its plan for Red Hat OpenStack Platform 16.2, 17.1 and 18.0 is none available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Manila (OpenStack) Fixed in 20.0.3, 21.0.3, 22.0.2, 23.0.1

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-71195
  2. 2026-10-21 Alias added: GHSA-xm2x-8fhq-8hpv
  3. 2026-10-21 Affected versions changed · Red Hat
  4. 2026-10-21 CVSS score added · Red Hat
  5. 2026-10-27 CISA SSVC decision points changed
  6. 2026-10-27 Priority changed: MEDIUM → HIGH
  7. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 2

Other 1

  • TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
  • TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
  • TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
  • TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
  • TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
  • TI-2026-37300 Resource allocation without limits in OpenStack Ironic CVSS 3.1HIGH 7.5
See all 332 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences