Debian/cyborg: medium 6.3
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), dat
Action: Upgrade cyborg to 16.0.0+git+2026.04.26.b8edfa06f1-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 16.0.0+git+2026.04.26.b8edfa06f1-1 | - |
Fixed versions
| 16.0.0+git+2026.04.26.b8edfa06f1-1 |
Sources
- osv: DEBIAN-CVE-2026-40214#Debian:14/cyborg
- https://security-tracker.debian.org/tracker/CVE-2026-40214
published · modified · JSON