Openstack Cyborg vulnerabilities

• openstack cyborg OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer CVE-2026-40214 Fix available 6.3 MediumMay 7, 2026
• openstack cyborg OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints CVE-2026-40213 Fix available 7.4 HighMay 7, 2026