---
id: "CVE-2026-93856"
kind: "vulnerability"
aliases: ["CVE-2026-93856"]
title: "OpenStack Cinder: Messages API leaks other projects' resource UUIDs to users"
severity: "medium"
cvss: 4.3
epss: 0.00314
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cinder", "infrastructure", "multi-tenant", "openstack", "self-hosted"]
not_affected_if: ["single-project-deployment"]
published_at: "2026-10-21T06:16:51+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:37:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93856", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-93856", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# OpenStack Cinder: Messages API leaks other projects' resource UUIDs to users

OpenStack Cinder through 29.0.0 returns non-expired user messages belonging to other projects in the Block Storage API v3.3 'List messages' response. A non-admin user with the project-scoped member or reader role can read the UUIDs of other projects' resources plus the generic messages about them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cinder version against `29.0.0` (unknown whether a fixed version exists in the sources)
- Confirm the Block Storage API microversion in use supports `3.3` and that the Messages API is exposed to project users

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93856
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-93856

## From the sources

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_