https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:39:18.826084+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-40213 CVE-2026-40213 2026-10-04T03:39:18.827713+00:00

Affected: OpenStack Cyborg

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

 https://cve.radiocsirt.org/vuln/ghsa-mm7j-mhhj-hj36 GHSA-mm7j-mhhj-hj36 — OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints 2026-10-04T03:39:18.827765+00:00

Affected: PyPI: openstack-cyborg

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.