{"id":"CVE-2026-93856","kind":"vulnerability","aliases":["CVE-2026-93856"],"related":[],"title":"OpenStack Cinder: Messages API leaks other projects' resource UUIDs to users","description":"In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 \"List messages\" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.","summary":"OpenStack Cinder through 29.0.0 returns non-expired user messages belonging to other projects in the Block Storage API v3.3 'List messages' response. A non-admin user with the project-scoped member or reader role can read the UUIDs of other projects' resources plus the generic messages about them.","severity":"medium","cvss":4.3,"epss":0.00314,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cinder","infrastructure","multi-tenant","openstack","self-hosted"],"not_affected_if":["single-project-deployment"],"how_to_check":"- Check the installed Cinder version against `29.0.0` (unknown whether a fixed version exists in the sources)\n- Confirm the Block Storage API microversion in use supports `3.3` and that the Messages API is exposed to project users","fix":null,"status":"open","published_at":"2026-10-21T06:16:51+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:37:41+00:00","updated_at":"2026-10-25T04:37:41+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:37:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenStack Cinder: Messages API leaks other projects' resource UUIDs to users","impact":"low","summary":"OpenStack Cinder through 29.0.0 returns non-expired user messages belonging to other projects in the Block Storage API v3.3 'List messages' response. A non-admin user with the project-scoped member or reader role can read the UUIDs of other projects' resources plus the generic messages about them.","category":"infrastructure","nicknames":[],"who_cares":["openstack","cinder","self-hosted","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other projects' resource UUIDs and generic messages readable by a project member","analyst_note":"Find the fixed Cinder release and the OpenStack advisory on the NVD page; the sources give no fix version.","how_to_check":"- Check the installed Cinder version against `29.0.0` (unknown whether a fixed version exists in the sources)\n- Confirm the Block Storage API microversion in use supports `3.3` and that the Messages API is exposed to project users","needs_analyst":true,"not_affected_if":["single-project-deployment"],"who_is_affected":"All Cinder deployments are affected according to the description. The exposure is for multi-project clouds where non-admin project members can call the Messages API; single-tenant deployments with one project have no other projects to leak from. Operators should look at any OpenStack cloud that runs Cinder for multiple tenants.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3422,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93856':14A,17A '29.0.0':30B,80C 'addit':142C 'admin':53B,95C 'affect':163C 'api':4A,45B,91C,110C 'belong':37B 'block':43B,108C 'call':114C 'cinder':2A,18B,28B,78C,160C 'cross':82C 'cross-project':81C 'cve':12A,15A 'deploy':161C 'design':154C 'disclosur':85C 'expir':34B,119C 'find':115C 'generic':74B,157C 'host':26B 'includ':125C 'inform':84C 'infrastructur':19B 'leak':5A 'leakag':132C 'list':47B,112C 'make':106C 'member':60B,102C 'messag':3A,36B,48B,75B,90C,113C,121C,146C,158C 'multi':21B 'multi-ten':20B 'non':33B,52B,94C,118C 'non-admin':51B,93C 'non-expir':32B,117C 'occur':87C 'openstack':1A,23B,27B,77C 'own':137C 'plus':72B 'project':7A,40B,58B,70B,83C,100C,124C,140C,150C 'project-scop':57B,99C 'read':65B 'reader':62B,104C 'resourc':8A,71B,136C,151C 'respons':49B,128C 'result':129C 'return':31B 'role':63B,105C 'sanit':156C 'scope':59B,101C 'self':25B 'self-host':24B 'storag':44B,109C 'tenant':22B 'user':11A,35B,54B,96C,120C,145C 'uuid':9A,67B,134C 'v3.3':46B,111C","nicknames":[],"mitigations":[],"who_affected":"All Cinder deployments are affected according to the description. The exposure is for multi-project clouds where non-admin project members can call the Messages API; single-tenant deployments with one project have no other projects to leak from. Operators should look at any OpenStack cloud that runs Cinder for multiple tenants.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93856","severity":null,"published_at":"2026-10-21T06:16:51+00:00","modified_at":"2026-10-22T17:16:02+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93856","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93856","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}