Skip to content
OpenAdvisories

Product · OpenStack

Cyborg

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-40213

    OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

    OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated us…

    OpenStack Cyborg cyborg openstack-cyborg Debian Ubuntu PyPI