================================================================================ ================================================================================

:Date: September 21, 2026 :CVE: CVE-2026-93852, CVE-2026-93854

Affects ~~~~~~~ - Blazar: >=1.0.0 <15.1.1, ==16.0.0, ==17.0.0

Description ~~~~~~~~~~~ Rohan Das from the University of Engineering and Management, Kolkata, reported that the Blazar V2 lease API does not enforce object-level authorization on its update and delete operations. As a result, any authenticated user who knows a lease ID can modify or delete leases belonging to other users and projects.

The same reporter found that the Blazar V2 lease listing operation returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user can enumerate other projects' leases, exposing lease and reservation identifiers along with reservation metadata. The exposed identifiers enable the object-level authorization bypass described above, allowing an attacker to then modify or delete the enumerated leases.

Only deployments that enable Blazar's V2 lease API are affected. Deployers that do not use the V2 API endpoint can set apiv2controllers to an empty value in the [api] section of blazar.conf. Patches below address the issue if the API controllers cannot be disabled.

Patches ~~~~~~~ - https://review.opendev.org/1006053 (2025.1/epoxy) - https://review.opendev.org/1006052 (2025.2/flamingo) - https://review.opendev.org/1006051 (2026.1/gazpacho) - https://review.opendev.org/1006050 (2026.2/hibiscus) - https://review.opendev.org/1006049 (2027.1/indri (development))

Credits ~~~~~~~ - Rohan Das from University of Engineering and Management, Kolkata

References ~~~~~~~~~~ - https://launchpad.net/bugs/2162719 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93852 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93854

Notes ~~~~~ - A single patch on each branch fixes both vulnerabilities.

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{leaseid} and DELETE /v2/leases/{leaseid}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "leaseid" whereas the controller methods name the parameter "id" (and the wsmepecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own projectid/userid instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check.

In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases.