CVE-2026-40214
CVE-2026-40214 is a medium-severity vulnerability with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-282.
Key facts
- Severity: Medium (CVSS 3.x base score 6.3)
- EPSS exploit prediction: 0% (11th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-28456
- Weakness: CWE-282
- Published:
- Last modified:
Description
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
Frequently asked questions
- What is CVE-2026-40214?
- In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
- How severe is CVE-2026-40214?
- CVE-2026-40214 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
- Is CVE-2026-40214 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-40214?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-40214 have an EU (EUVD) identifier?
- Yes. CVE-2026-40214 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-28456.
- When was CVE-2026-40214 published?
- CVE-2026-40214 was published on 2026-05-07 and last updated on 2026-06-17.
References
- https://bugs.launchpad.net/openstack-cyborg/+bug/2144056
- https://security.openstack.org/ossa/OSSA-2026-011.html
- https://www.openwall.com/lists/oss-security/2026/05/07/6
Other CWE-282 vulnerabilities
- CVE-2026-23514 — High (CVSS 8.8): Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control…
- CVE-2020-10632 — High (CVSS 8.8): Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of…
- CVE-2025-27254 — High (CVSS 8.0): CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The…
- CVE-2024-39755 — High (CVSS 7.8): A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially…
- CVE-2024-37999 — High (CVSS 7.8): A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application…
- CVE-2023-0386 — High (CVSS 7.8): A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities…