{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"cinder","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NWYGV42N9TJAMGBCF4C1W5","modified_at":"2026-10-31T04:00:07.321546846Z","published_at":"2026-10-21T06:16:51.017Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-93856","https://security-tracker.debian.org/tracker/CVE-2026-93856"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-93856","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-93856"}],"summary":"In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API"}