https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:35:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-40213 <p><strong>Affected:</strong> OpenStack Cyborg</p> <p>OpenStack Cyborg before 16.0.1 uses rule:allow (check_str=&#39;@&#39;) as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.</p> <p><strong>Affected:</strong> OpenStack Cyborg</p> <p>OpenStack Cyborg before 16.0.1 uses rule:allow (check_str=&#39;@&#39;) as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.</p> https://vulnerability.circl.lu/vuln/cve-2026-40213 https://vulnerability.circl.lu/vuln/usn-8413-1 <p><strong>Affected:</strong> Ubuntu:25.10: cyborg, Ubuntu:26.04:LTS: cyborg</p> <p>It was discovered that Cyborg did not properly enforce project ownership in the Accelerator Request (ARQ) API. An authenticated user could possibly use this issue to delete ARQs bound to other projects&#39; instances, resulting in a cross-tenant denial of service. (CVE-2026-40214)</p> <p>It was discovered that Cyborg used a permissive default policy that authorized any request carrying a valid authentication token, regardless of roles or scope, for multiple API endpoints. An authenticated user could possibly use this issue to perform unauthorized actions, such as reprogramming FPGA bitstreams on arbitrary compute nodes. (CVE-2026-40213)</p> <p><strong>Affected:</strong> Ubuntu:25.10: cyborg, Ubuntu:26.04:LTS: cyborg</p> <p>It was discovered that Cyborg did not properly enforce project ownership in the Accelerator Request (ARQ) API. An authenticated user could possibly use this issue to delete ARQs bound to other projects&#39; instances, resulting in a cross-tenant denial of service. (CVE-2026-40214)</p> <p>It was discovered that Cyborg used a permissive default policy that authorized any request carrying a valid authentication token, regardless of roles or scope, for multiple API endpoints. An authenticated user could possibly use this issue to perform unauthorized actions, such as reprogramming FPGA bitstreams on arbitrary compute nodes. (CVE-2026-40213)</p> https://vulnerability.circl.lu/vuln/usn-8413-1