Vulnerabilities of OpenStack Cyborg
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-40213 | OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints | 7.4 High | May 7, 2026 |
| CVE-2026-40214 | In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer | 6.3 Medium | May 7, 2026 |