https://seclists.org/oss-sec/2026/q3/853: [OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)

Q: Which deployments are exposed?

Only deployments with the Blazar V2 lease API enabled are affected. The affected Blazar versions are >=1.0.0 and <15.1.1, plus 16.0.0 and 17.0.0.

Q: What does an attacker need to exploit these issues?

An attacker needs to be an authenticated user. They can use the V2 lease listing operation to enumerate leases from other projects and obtain lease identifiers, then use those identifiers to modify or delete the leases.

Q: What information can unauthorized users access through the listing issue?

Authenticated users can list leases for every project rather than only their own project. The exposed data includes lease and reservation identifiers and reservation metadata.

Q: How can I determine whether my deployment is affected?

Check whether the Blazar V2 lease API is enabled and whether the deployed version falls within the affected version ranges. Deployments that do not use the V2 API endpoint are not affected.

Published Sep 21, 2026

Updated

Affected Software

1 affected component

Openstack Blazar>=1.0.0<15.1.1, =16.0.0, =17.0.0

Frequently Asked Questions

Which deployments are exposed?

Only deployments with the Blazar V2 lease API enabled are affected. The affected Blazar versions are >=1.0.0 and <15.1.1, plus 16.0.0 and 17.0.0.

What does an attacker need to exploit these issues?

An attacker needs to be an authenticated user. They can use the V2 lease listing operation to enumerate leases from other projects and obtain lease identifiers, then use those identifiers to modify or delete the leases.

What information can unauthorized users access through the listing issue?

Authenticated users can list leases for every project rather than only their own project. The exposed data includes lease and reservation identifiers and reservation metadata.

How can I determine whether my deployment is affected?

Check whether the Blazar V2 lease API is enabled and whether the deployed version falls within the affected version ranges. Deployments that do not use the V2 API endpoint are not affected.