CVE-2026-93856: Medium severity Openstack Cinder vulnerability
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.
Affected Software
Event History
Frequently Asked Questions
Which users can access the leaked information?
A non-admin user authenticated with a project-scoped member or reader role can retrieve it through the Block Storage API v3.3 List messages call.
What information is exposed across project boundaries?
The response can include non-expired user messages for other projects and the UUIDs of resources owned by those projects. The message text is sanitized to generic wording by design.
Are only specific deployment configurations affected?
No. The available information states that all Cinder deployments are affected.
How can an operator verify exposure?
Use a non-admin project-scoped member or reader account to make the Block Storage API v3.3 List messages request and check whether the response contains non-expired messages or resource UUIDs belonging to other projects.