CVE-2026-93852: Openstack Blazar vulnerability
In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Blazarto a version that resolves this vulnerability.Fixed in 17.0.1 - Compensating control
Restrict access to the Blazar REST API (including the V2 lease listing endpoint GET /v2/leases) so only administrators or trusted callers can enumerate leases across projects/tenants.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can access the Blazar REST API can exploit it. The issue affects the V2 lease listing endpoint, which returns lease information across projects without project scoping or an administrator-only policy.
What information can be exposed?
An attacker can enumerate leases belonging to other tenants and obtain lease IDs, reservation IDs, resource IDs, and reservation metadata.
Does exposure of lease data lead to further impact?
Yes. The disclosed lease IDs can be used with the companion object-level authorization bypass to modify or delete enumerated leases.
What version addresses the issue?
Upgrade OpenStack Blazar to version 17.0.1 or later. Versions before 17.0.1 are affected.