CVE-2026-93852: [OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)

Q: Who can exploit this issue?

Any authenticated user who can access the Blazar REST API can exploit it. The issue affects the V2 lease listing endpoint, which returns lease information across projects without project scoping or an administrator-only policy.

Q: What information can be exposed?

An attacker can enumerate leases belonging to other tenants and obtain lease IDs, reservation IDs, resource IDs, and reservation metadata.

Q: Does exposure of lease data lead to further impact?

Yes. The disclosed lease IDs can be used with the companion object-level authorization bypass to modify or delete enumerated leases.

Q: What version addresses the issue?

Upgrade OpenStack Blazar to version 17.0.1 or later. Versions before 17.0.1 are affected.

Published Sep 18, 2026

Updated

In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases.

Affected Software

1 affected component

Openstack Blazar<17.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenStack Blazar to a version that resolves this vulnerability.
Fixed in 17.0.1Patch OSSA-2026-040
Configuration
Patch/align Blazar so GET /v2/leases enforces project/tenant scoping and does not return leases for other projects to non-admin authenticated users.
OpenStack Blazar V2 lease API Project scoping / administrator-only authorization for GET /v2/leases = Enable enforcement of project scoping and require administrator-only access (no cross-tenant lease enumeration)

Event History

Sep 18, 2026

CVE Published

via MITRE·06:48 PM

Data Sourced

via MITRE·06:48 PM

DescriptionWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Feb 1, 58701

Event

via FIRST·05:18 PM

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user who can access the Blazar REST API can exploit it. The issue affects the V2 lease listing endpoint, which returns lease information across projects without project scoping or an administrator-only policy.

What information can be exposed?