OpenStack Manila <23.0.1 PrivEsc via Public Share API
CVE-2026-71195 Published on October 21, 2026
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.
Vulnerability Analysis
CVE-2026-71195 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-71195. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-71195 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71195
Want to know whenever a new CVE is published for OpenStack Manila? stack.watch will email you.
Affected Versions
OpenStack Manila:- Version 1.0.0 and below 20.0.3 is affected.
- Version 21.0.0 and below 21.0.3 is affected.
- Version 22.0.0 and below 22.0.2 is affected.
- Version 23.0.0 and below 23.0.1 is affected.