https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:07:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309177 EUVD-2026-309177 https://cve.radiocsirt.org/vuln/euvd-2026-309177 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40214 <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40214 https://cve.radiocsirt.org/vuln/ghsa-mmpc-xjxr-5hf8 <p><strong>Affected:</strong> PyPI: openstack-cyborg</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> <p><strong>Affected:</strong> PyPI: openstack-cyborg</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> https://cve.radiocsirt.org/vuln/ghsa-mmpc-xjxr-5hf8 https://cve.radiocsirt.org/vuln/pysec-2026-2854 <p><strong>Affected:</strong> PyPI: openstack-cyborg</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> <p><strong>Affected:</strong> PyPI: openstack-cyborg</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2854 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40214 <p><strong>Affected:</strong> Ubuntu:25.10: cyborg, Ubuntu:26.04:LTS: cyborg</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> <p><strong>Affected:</strong> Ubuntu:25.10: cyborg, Ubuntu:26.04:LTS: cyborg</p> <p>In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller&#39;s project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects&#39; instances, aka cross-tenant denial of service.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40214