{"id":"CVE-2026-40214","aliases":["GHSA-mmpc-xjxr-5hf8","PYSEC-2026-2854"],"title":"OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer","summary":"OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","vendor":"openstack-cyborg","product":"openstack-cyborg","ecosystem":"pip","affected":["openstack-cyborg < 16.0.1"],"patched":["openstack-cyborg 16.0.1"],"published":"2026-05-08","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mmpc-xjxr-5hf8","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40214"},{"url":"https://bugs.launchpad.net/openstack-cyborg/+bug/2144056"},{"url":"https://github.com/openstack/cyborg"},{"url":"https://security.openstack.org/ossa/OSSA-2026-011.html"},{"url":"https://www.openwall.com/lists/oss-security/2026/05/07/6"}],"tags":["osv","pip"],"epss":0.00206,"epssPercentile":0.11045,"ingestedAt":"2026-07-13T18:58:00.776Z","slug":"CVE-2026-40214","body":"## Overview\n\nIn OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.\n\n## Affected packages\n\n- `openstack-cyborg < 16.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openstack-cyborg 16.0.1`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}