CVE-2026-93856
Last modified
CVE-2026-93856 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| OpenStack | Cinder | >= 9.0.0, < 26.3.1; 27.0.0; 28.0.0; 29.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-93856?
How severe is CVE-2026-93856?
How do I fix CVE-2026-93856?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-93850Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7…6.5
- CVE-2026-93851Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7…8
- CVE-2026-93852In OpenStack Blazar before 17.0.1, the V2 lease listing oper…7.1
- CVE-2026-93853Unverified ownership in Barman snapshot backup deletion allo…7.2
- CVE-2026-93854In OpenStack Blazar before 17.0.1, the V2 lease API does not…7.2
- CVE-2026-93855The SendPress Newsletters plugin for WordPress is vulnerable…7.5
- CVE-2026-93857A stack-based buffer overflow vulnerability in Fireware OS's…9.2
- CVE-2026-93858In OpenStack Mistral through 23.0.0, the std.ssh_proxied act…8.7
- CVE-2026-9386A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
- CVE-2026-93860In OpenStack Mistral through 23.0.0, the /v2/maintenance API…7.1
- CVE-2026-93861In OpenStack Mistral through 23.0.0, the workflow membership…6
- CVE-2026-93862An out-of-bounds read vulnerability in the FireCluster Sync …7.2
Are you affected by CVE-2026-93856?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST