Every CVESearch/Get API key

CVE-2026-71195

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify...

9.9 CriticalFix available

CVE-2026-71195 is a critical vulnerability (CVSS 9.9) in Openstack Manila, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in manila 1:23.0.0-4.

What does this mean?
Severity
9.9 CriticalCVSS 3.1, CVE List
Exploit chance
0.48%EPSS, 42nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1:23.0.0-4manila +12 more

Description

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.48%Unchanged since Oct 21, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
manila
Debian:12
All versions, plus listed versions
1:15.1.0-21:16.0.0-11:16.0.0-21:16.0.0-31:16.0.0-4
Show 42 moreShow less
1:16.0.0~rc1-11:17.0.0-11:17.0.0~rc1-11:17.1.0-11:18.0.0~rc1-11:18.0.1-11:18.1.0-11:18.1.0-21:19.0.0-11:19.0.0-21:19.0.0-31:19.0.0-41:19.0.0~rc1-11:19.0.0~rc1-21:19.0.1-11:20.0.0-11:20.0.0-21:20.0.0-31:20.0.0~rc1-11:20.0.0~rc1-21:21.0.0-11:21.0.0-21:21.0.0~rc1-11:21.0.0~rc1-21:21.0.0~rc2-11:22.0.0-11:22.0.0-21:22.0.0-31:22.0.0-41:22.0.0~rc1-11:22.0.0~rc1-21:22.0.0~rc2-11:22.0.0~rc2-21:22.0.0~rc2-31:22.0.0~rc2-41:22.0.1-11:23.0.0-11:23.0.0-21:23.0.0-31:23.0.0-41:23.0.0~rc1-11:23.0.0~rc1-2
None known
manila
Debian:13
All versions, plus listed versions
1:20.0.0-31:21.0.0-11:21.0.0-21:21.0.0~rc1-11:21.0.0~rc1-2
Show 18 moreShow less
1:21.0.0~rc2-11:22.0.0-11:22.0.0-21:22.0.0-31:22.0.0-41:22.0.0~rc1-11:22.0.0~rc1-21:22.0.0~rc2-11:22.0.0~rc2-21:22.0.0~rc2-31:22.0.0~rc2-41:22.0.1-11:23.0.0-11:23.0.0-21:23.0.0-31:23.0.0-41:23.0.0~rc1-11:23.0.0~rc1-2
None known
manila
Debian:14
before 1:23.0.0-4, plus listed versions
1:20.0.0-31:21.0.0-11:21.0.0-21:21.0.0~rc1-11:21.0.0~rc1-2
Show 17 moreShow less
1:21.0.0~rc2-11:22.0.0-11:22.0.0-21:22.0.0-31:22.0.0-41:22.0.0~rc1-11:22.0.0~rc1-21:22.0.0~rc2-11:22.0.0~rc2-21:22.0.0~rc2-31:22.0.0~rc2-41:22.0.1-11:23.0.0-11:23.0.0-21:23.0.0-31:23.0.0~rc1-11:23.0.0~rc1-2
1:23.0.0-4
openstack-manila
Red Hat:openstack:17.1::el9
before 1:12.1.3-17.1.20240829070803.ba479a4.el9ost
1:12.1.3-17.1.20240829070803.ba479a4.el9ost
openstack-manila-share
Red Hat:openstack:17.1::el9
before 1:12.1.3-17.1.20240829070803.ba479a4.el9ost
1:12.1.3-17.1.20240829070803.ba479a4.el9ost
python3-manila
Red Hat:openstack:17.1::el9
before 1:12.1.3-17.1.20240829070803.ba479a4.el9ost
1:12.1.3-17.1.20240829070803.ba479a4.el9ost
manila
Ubuntu:16.04:LTS
All versions, plus listed versions
1:1.0.0-0ubuntu11:2.0.0~b1-0ubuntu11:2.0.0~b2-0ubuntu11:2.0.0~b3-0ubuntu11:2.0.0~rc1-0ubuntu11:2.0.0-0ubuntu1
None known
manila
Ubuntu:18.04:LTS
All versions, plus listed versions
1:5.0.0-0ubuntu11:6.0.0~b2-0ubuntu11:6.0.0~b3-0ubuntu11:6.0.0~rc1-0ubuntu11:6.0.0~rc2-0ubuntu11:6.0.0~rc3-0ubuntu11:6.0.0-0ubuntu1
None known
manila
Ubuntu:20.04:LTS
All versions, plus listed versions
1:9.0.0-0ubuntu11:10.0.0~b1~git2019121913.02b2903f-0ubuntu11:10.0.0~b2~git2020020609.19877429-0ubuntu11:10.0.0~b3~git2020032516.cb016333-0ubuntu11:10.0.0~b3~git2020041013.ea90fd17-0ubuntu11:10.0.0-0ubuntu0.20.04.11:10.0.0-0ubuntu0.20.04.2
None known
manila
Ubuntu:22.04:LTS
All versions, plus listed versions
1:13.0.0-0ubuntu11:13.0.1+git2021120816.1856bf632-0ubuntu11:13.0.1+git2022011217.603e484fb-0ubuntu11:13.0.1+git2022011217.603e484fb-0ubuntu21:13.0.2+git2022030313.3ce3854ae-0ubuntu1
Show 7 moreShow less
1:14.0.0-0ubuntu11:14.0.1-0ubuntu11:14.1.0-0ubuntu11:14.1.1-0ubuntu11:14.1.1-0ubuntu1.11:14.1.1-0ubuntu1.21:14.1.1-0ubuntu1.3
None known
manila
Ubuntu:24.04:LTS
All versions, plus listed versions
1:17.0.0-0ubuntu11:17.2.0+git2024020611.796037ea-0ubuntu11:18.0.0~rc1-0ubuntu11:18.0.1-0ubuntu11:18.0.1-0ubuntu21:18.0.1-0ubuntu2.11:18.0.1-0ubuntu2.21:18.0.1-0ubuntu2.3
None known
manila
Ubuntu:26.10
All versions, plus listed versions
1:22.0.0-0ubuntu21:22.0.0+git20260814.232.57a2239-0ubuntu11:23.0.0~rc1-0ubuntu11:23.0.0-0ubuntu1
None known
manila
Ubuntu:26.04:LTS
All versions, plus listed versions
1:21.0.0-0ubuntu11:21.0.0+git20260126.6017d99-0ubuntu11:22.0.0~rc2-0ubuntu11:22.0.0-0ubuntu11:22.0.0-0ubuntu2
None known

What each source reports

CVE List Score used9.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
CVE-2026-71195
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-1070469.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
EUVD-2026-107046
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-xm2x-8fhq-8hpv9.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify...

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
GHSA-xm2x-8fhq-8hpv
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
NVD9.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
CVE-2026-71195
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSV9.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
CVE-2026-71195
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSVDEBIAN-CVE-2026-711959.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
DEBIAN-CVE-2026-71195
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:999478.8

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-manila) security update

Record
RHSA-2026:99947
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-711959.9

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Record
UBUNTU-CVE-2026-71195
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 10 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open