Home
HIGH: 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LDefault status
unaffected
5.0.0 (semver) before 14.0.1
affected
15.0.0 (semver) before 15.0.1
affected
16.0.0 (semver) before 16.0.1
affected
Description
OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.
Problem types
CWE-863 Incorrect Authorization
Product status
5.0.0 (semver) before 14.0.1
15.0.0 (semver) before 15.0.1
16.0.0 (semver) before 16.0.1
References
bugs.launchpad.net/openstack-cyborg/+bug/2143263
www.openwall.com/lists/oss-security/2026/05/07/6