CVE-2026-93856Medium· 4.3▾ SunlitIn OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the n…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.
Cinder >= 9.0.0 < 26.3.1Cinder 27.0.0Cinder 28.0.0Cinder 29.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-24708High· 8.2An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1
CVE-2020-10755Medium· 6.5Openstack cinder Improper handling of ScaleIO backend credentials
CVE-2024-32498Medium· 6.5OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
CVE-2014-3641MediumOpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2013-4202MediumOpenStack Cinder Denial of Service using XML entities
CVE-2015-5162High· 7.5OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption