Cyborg (Openstack) - vulnerabilities (CVEs)

2 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-05-07. Vendor: Openstack.

CVEs of Cyborg

• CVE-2026-40214 - CVSS 6.3 (medium), 2026-05-07: In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is…
• CVE-2026-40213 - CVSS 7.4 (high), 2026-05-07: OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request…