Live › vulnerability › CVE-2026-93856
Go to dashboardOpenStack Cinder through 29.0.0 returns non-expired user messages belonging to other projects in the Block Storage API v3.3 'List messages' response. A non-admin user with the project-scoped member or reader role can read the UUIDs of other projects' resources plus the generic messages about them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
All Cinder deployments are affected according to the description. The exposure is for multi-project clouds where non-admin project members can call the Messages API; single-tenant deployments with one project have no other projects to leak from. Operators should look at any OpenStack cloud that runs Cinder for multiple tenants.
No product ranges from the sources yet.
29.0.0 (unknown whether a fixed version exists in the sources)3.3 and that the Messages API is exposed to project usersUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93856")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.