CVE-2026-40213

{
  "id": "CVE-2026-40213",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T22:16:34.910",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC."
    },
    {
      "lang": "es",
      "value": "OpenStack Cyborg anterior a la versión 16.0.1 utiliza la regla:allow (check_str=’@’) como política predeterminada para múltiples puntos finales de API. Esto autoriza incondicionalmente cualquier solicitud que lleve un token de Keystone válido, independientemente de los roles, la pertenencia al proyecto o el alcance. Un usuario autenticado sin asignaciones de rol puede completar varias acciones, como la reprogramación de bitstreams de FPGA en nodos de cómputo arbitrarios a través de RPC de agente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenStack",
          "product": "Cyborg",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.0.0",
              "lessThan": "14.0.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.0.0",
              "lessThan": "15.0.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "16.0.0",
              "lessThan": "16.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 3.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T13:55:42.638626Z",
          "id": "CVE-2026-40213",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.launchpad.net/openstack-cyborg/+bug/2143263",
      "source": "[email protected]"
    },
    {
      "url": "https://security.openstack.org/ossa/OSSA-2026-011.html",
      "source": "[email protected]"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2026/05/07/6",
      "source": "[email protected]"
    }
  ]
}