Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:39:16 +0000 CVE-2026-40213 https://cve.radiocsirt.org/vuln/cve-2026-40213 <p><strong>Affected:</strong> OpenStack Cyborg</p> <p>OpenStack Cyborg before 16.0.1 uses rule:allow (check_str=&#39;@&#39;) as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.</p> <p><strong>Affected:</strong> OpenStack Cyborg</p> <p>OpenStack Cyborg before 16.0.1 uses rule:allow (check_str=&#39;@&#39;) as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.</p> https://cve.radiocsirt.org/vuln/cve-2026-40213 GHSA-mm7j-mhhj-hj36 — OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints https://cve.radiocsirt.org/vuln/ghsa-mm7j-mhhj-hj36 <p><strong>Affected:</strong> PyPI: openstack-cyborg</p> <p>OpenStack Cyborg before 16.0.1 uses rule:allow (check_str=&#39;@&#39;) as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.</p> <p><strong>Affected:</strong> PyPI: openstack-cyborg</p> <p>OpenStack Cyborg before 16.0.1 uses rule:allow (check_str=&#39;@&#39;) as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.</p> https://cve.radiocsirt.org/vuln/ghsa-mm7j-mhhj-hj36