CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.
CVE-2026-93856
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93856
Cinder
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://opendev.org/openstack/cinder",
"vendor": "OpenStack",
"modules": [
"Block Storage API version 3.3"
],
"product": "Cinder",
"versions": [
{
"status": "affected",
"version": "9.0.0",
"lessThan": "26.3.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "27.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "28.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "29.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-93856
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #49408 · Revision 1
- Added to Heist Feed
- Publisher date