Skip to content
OpenAdvisories

Package · PyPI

openstack-cyborg

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.4
    CVE-2026-40213

    OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

    OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated us…

    OpenStack Cyborg openstack-cyborg cyborg Debian Ubuntu PyPI
  • Medium 6.3
    CVE-2026-40214

    OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer

    In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks …

    OpenStack Cyborg cyborg openstack-cyborg Debian Ubuntu PyPI