https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:06:59.760878+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-309177 EUVD-2026-309177 2026-10-04T00:06:59.845622+00:00 EUVD-2026-309177 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40214 fkie_cve-2026-40214 2026-10-04T00:06:59.845660+00:00

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-mmpc-xjxr-5hf8 GHSA-mmpc-xjxr-5hf8 — OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer 2026-10-04T00:06:59.845696+00:00

Affected: PyPI: openstack-cyborg

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

 https://cve.radiocsirt.org/vuln/pysec-2026-2854 PYSEC-2026-2854 — OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer 2026-10-04T00:06:59.845724+00:00

Affected: PyPI: openstack-cyborg

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40214 UBUNTU-CVE-2026-40214 2026-10-04T00:06:59.845746+00:00

Affected: Ubuntu:25.10: cyborg, Ubuntu:26.04:LTS: cyborg

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.