Debian/cyborg: high 7.4
OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless
Action: Upgrade cyborg to 16.0.0+git+2026.04.26.b8edfa06f1-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 16.0.0+git+2026.04.26.b8edfa06f1-1 | - |
Fixed versions
| 16.0.0+git+2026.04.26.b8edfa06f1-1 |
Sources
- osv: DEBIAN-CVE-2026-40213#Debian:14/cyborg
- https://security-tracker.debian.org/tracker/CVE-2026-40213
published · modified · JSON