Critical 9.9Published Oct 21, 2026

CVE-2026-71195In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.

Updated under an hour ago (Oct 27, 2026, 6:40 AM ET)

Does this affect you?

It affects OpenStack Manila. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.48%, higher than 41% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OpenStack Manila

Exploited in the last 30 days

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

CVSS: 9.9 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.48% (percentile 41)
Assigned by: mitre
NVD analysis: Awaiting Analysis
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 21, 2026

Affected products

Affected products

OpenStack Manila openstack:manila (from the name)	from 1.0.0 before 20.0.3; from 21.0.0 before 21.0.3; from 22.0.0 before 22.0.2; from 23.0.0 before 23.0.1	CNA record

References

References

https://launchpad.net/bugs/2161412	issue-tracking
https://openwall.com/lists/oss-security/2026/10/20/18	mailing-list, vendor-advisory
https://security.openstack.org/ossa/OSSA-2026-046.html	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/10/20/18

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.