RHSA-2026:99947: Critical: Red Hat OpenStack Platform 17.1 (openstack-manila) security update
Critical: Red Hat OpenStack Platform 17.1 (openstack-manila) security update
Other sources
Manila is designed to provide a multi-tenant, secure file share as aservice across OpenStack Compute instancesSecurity Fix(es): manila: Public Manila Share Allows Cross-Project Access-Rule and Export-Metadata Writes (CVE-2026-71195)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openstack-manilato a version that resolves this vulnerability.Fixed in 12.1.3-17.1.20240829070803.ba479a4.el9 - Upgrade
Upgrade
redhat/openstack-manila-shareto a version that resolves this vulnerability.Fixed in 12.1.3-17.1.20240829070803.ba479a4.el9 - Upgrade
Upgrade
redhat/python3-manilato a version that resolves this vulnerability.Fixed in 12.1.3-17.1.20240829070803.ba479a4.el9
Event History
Frequently Asked Questions
What environment should be prioritized for remediation?
The advisory applies to Red Hat OpenStack Platform 17.1 and lists openstack-manila, openstack-manila-share, and python3-manila. Deployments using Manila file-share services should be prioritized, particularly where public shares are present.
What condition is associated with exploitation?
The issue specifically involves a public Manila share. The advisory indicates that such a share can permit cross-project writes to access rules and export metadata.
Can affected package versions be identified from this advisory data?
No affected or fixed package version numbers are provided in the available data. The provided information identifies the Red Hat OpenStack Platform 17.1 advisory and the related Manila packages.